Network Connection Initiated From Process Located In Potentially Suspicious Or Uncommon Location

{
  "network_connection": {
    "EventID": 3,
    "Channel": "Microsoft-Windows-Sysmon/Operational"
  },
  "selection": {
    "Initiated": "true",
    "Image
| contains": [
      ":\\$Recycle.bin",
      ":\\Perflogs\\",
      ":\\Temp\\",
      ":\\Users\\Default\\",
      ":\\Users\\Public\\",
      ":\\Windows\\Fonts\\",
      ":\\Windows\\IME\\",
      ":\\Windows\\System32\\Tasks\\",
      ":\\Windows\\Tasks\\",
      "\\config\\systemprofile\\",
      "\\Contacts\\",
      "\\Favorites\\",
      "\\Favourites\\",
      "\\Music\\",
      "\\Pictures\\",
      "\\Videos\\",
      "\\Windows\\addins\\"
    ]
  },
  "filter_main_domains": {
    "DestinationHostname
| endswith": [
      ".githubusercontent.com",
      "0x0.st",
      "anonfiles.com",
      "bashupload.com",
      "cdn.discordapp.com",
      "chunk.io",
      "ddns.net",
      "dl.dropboxusercontent.com",
      "ghostbin.co",
      "github.com",
      "glitch.me",
      "gofile.io",
      "hastebin.com",
      "mediafire.com",
      "mega.co.nz",
      "mega.nz",
      "onrender.com",
      "pages.dev",
      "paste.ee",
      "pastebin.com",
      "pastebin.pl",
      "pastetext.net",
      "portmap.io",
      "privatlab.com",
      "privatlab.net",
      "send.exploit.in",
      "sendspace.com",
      "storage.googleapis.com",
      "storjshare.io",
      "supabase.co",
      "temp.sh",
      "transfer.sh",
      "trycloudflare.com",
      "ufile.io",
      "w3spaces.com",
      "workers.dev",
      "x0.at"
    ]
  },
  "condition": "network_connection and (selection and not 1 of filter_main_*)"
}

False Positives

• ⚠ Unknown