This anomaly rule targets LOLBAS (Living Off the Land Binaries and Scripts) that can legitimately initiate public network connections but do so over uncommon destination ports. It leverages the Network_Traffic data model (Sysmon EventID 3 as the data source) and applies per-binary port exclusions to reduce false positives while preserving suspicious, non-standard communication. The search enumerates a set of LOLBAS binaries (e.g., bitsadmin.exe, certutil.exe, cmstp.exe, cscript.exe, ftp.exe, hh.exe, ie4uinit.exe, ieexec.exe, msbuild.exe, msdt.exe, mshta.exe, msiexec.exe, presentationhost.exe, settingsynchost.exe, syncappvpublishingserver.exe, workfolders.exe, wscript.exe, wuauclt.exe) and filters out destinations that reside in common private or reserved ranges. It further excludes known benign port-usage patterns for certain binaries (e.g., standard web ports 80/443 for some scripts, FTP ports, or LDAP/389 for certutil/ie4uinit) to concentrate on anomalous port activity. The detection flags traffic where a LOLBAS binary connects to a public destination on an uncommon port, which may indicate payload download, command-and-control, proxy execution, or attempts to blend malicious traffic into trusted Windows binaries. Analysts are advised to join this with Process Execution events to provide contextual grounding and reduce noise. The rule notes potential legitimate scenarios (e.g., software installation, tooling, or update workflows) and recommends tuning destinations, ports, and paths to minimize false positives. References to LOLBAS and related detection approaches are provided, along with an MITRE-aligned context in the analytic narrative and risk context. If validated, this rule helps surface covert outbound behavior by legitimate binaries that may be co-opted for malicious purposes on endpoints.