It's Just A Connection.
Until The Pattern Repeats.

An alert triage reference for suspicious outbound or inbound connections: beaconing, C2, unusual port or protocol combinations, and geo-anomalies. What triggers this alert, how to work it in order, what separates a real compromise from routine noise, and when to stop triaging and escalate. For the filter syntax to actually inspect the capture, see Wireshark Display Filters.

IDS/IPS signature hit
├── A known-bad pattern matched inline traffic, both the source and destination are worth checking independently
└── Signature confidence varies by vendor and rule age
    // a signature hit tells you what matched, not why the traffic exists

NDR/UEBA beaconing detection
├── Regular time-interval outbound connections, flagged by behavioral analysis rather than a static signature
└── Beaconing detections are probabilistic, built from a statistical model of "normal" for that host
    // worth the extra look even without a signature, this is often the earliest signal available

Threat intel IOC match on destination
├── The destination IP or domain matches an indicator from a feed like VirusTotal, AbuseIPDB, or OTX
└── Match quality depends entirely on the feed's freshness and false positive rate
    // a stale IOC feed produces stale, sometimes wrong, matches

Protocol mismatch on a standard port
├── Traffic that doesn't match the expected protocol for that port, like raw TCP instead of TLS on port 443
└── A classic attempt to blend malicious traffic in with traffic that's normally allowed through
    // port number alone was never proof of protocol, packet inspection is what actually confirms it

Geo-anomaly
├── A connection to a sanctioned country or a region with no legitimate business reason for that org to reach
└── What counts as anomalous depends entirely on the business, a logistics firm and a domestic law office have very different baselines
    // geo rules need tuning per organization, a generic global list produces constant noise

1. Identify the alert trigger
├── A signature ID, a threat intel IOC match, or a behavioral anomaly like interval regularity on a suspected beacon
└── The trigger type sets how much you can trust the alert before you dig further
    // a behavioral flag needs more corroboration than a direct IOC match does

2. Identify the source host and, critically, the process
├── Find which binary actually opened the connection, not just which host it came from
└── EDR's process-to-connection mapping is the tool for this, the firewall log alone won't show it
    // the process is usually the fastest way to separate real from routine

3. Check destination reputation
├── WHOIS registration age, threat intel hits across VirusTotal, AbuseIPDB, and OTX, plus the hosting provider or ASN
└── A brand-new domain on a high-abuse ASN reads very differently than one on an established provider
    // reputation checks take minutes and rule out a lot of noise early

4. Check the connection pattern
├── One-off versus recurring, interval regularity consistent with beaconing, and the data volume transferred
└── A single small connection and a recurring session moving real volume are not the same case
    // pattern over time tells you more than any single connection ever will

5. Correlate with other alerts on the same host
├── Recent process execution, PowerShell activity, and persistence changes around the same window
└── A connection alert sitting next to a suspicious execution alert on the same host raises the stakes considerably
    // isolated alerts and correlated alerts get triaged very differently