Network Connection Initiated From Process Located In Potentially Suspicious Or Uncommon Location — Detection Rule

Detects a network connection initiated by programs or processes running from suspicious or uncommon files system locations.