Unconventional Outbound Connection

After an attacker compromises a device, they can install malware that attempts to contact a command-and-control (C&C) server outside the network or download additional malware from an attacker-controlled server. Unconventional connections with an external endpoint (where the internal device is not expected to communicate with the external endpoint) should be examined before critical or costly attacks occur.

The system might change the risk score for this detection.