hunting-for-unusual-network-connections

name	hunting-for-unusual-network-connections
description	Runs a hypothesis-driven threat hunt for command-and-control activity (T1071) by querying SIEM/EDR network telemetry for anomalous outbound traffic, rare destinations, non-standard ports, and unusual connection frequencies from endpoints. Use when hunting for beaconing/C2 traffic, after threat intel flags suspicious infrastructure, or when alerts fire on anomalous connections.
domain	cybersecurity
subdomain	threat-hunting
tags	["threat-hunting","mitre-attack","network-analysis","c2","anomaly-detection","proactive-detection"]
version	1.0
author	mahipal
license