Potentially Suspicious Malware Callback Communication

{
  "network_connection": {
    "EventID": 5156,
    "Channel": "Security"
  },
  "selection": {
    "Direction": "%%14593",
    "DestPort": [
      100,
      198,
      200,
      243,
      473,
      666,
      700,
      743,
      777,
      1443,
      1515,
      1777,
      1817,
      1904,
      1960,
      2443,
      2448,
      3360,
      3675,
      3939,
      4040,
      4433,
      4438,
      4443,
      4444,
      4455,
      5445,
      5552,
      5649,
      6625,
      7210,
      7777,
      8143,
      8843,
      9631,
      9943,
      10101,
      12102,
      12103,
      12322,
      13145,
      13394,
      13504,
      13505,
      13506,
      13507,
      14102,
      14103,
      14154,
      49180,
      65520,
      65535
    ]
  },
  "filter_main_local_ranges": {
    "DestAddress
| cidr": [
      "127.0.0.0/8",
      "10.0.0.0/8",
      "172.16.0.0/12",
      "192.168.0.0/16",
      "169.254.0.0/16",
      "::1/128",
      "fe80::/10",
      "fc00::/7"
    ]
  },
  "filter_optional_sys_directories": {
    "Application
| startswith": [
      "\\device\\harddiskvolume?\\Program Files\\",
      "\\device\\harddiskvolume?\\Program Files (x86)\\"
    ]
  },
  "condition": "network_connection and (selection and not 1 of filter_main_* and not 1 of filter_optional_*)"
}

False Positives

• ⚠ Unknown