This anomaly analysis detects rare outbound network activity originating from Living Off the Land Binaries and Scripts (LOLBAS) on endpoints. It leverages the Network_Traffic data model to identify native Windows binaries that typically do not require public network access but attempt to reach external destinations. The rule targets a curated set of LOLBAS apps (e.g., at.exe, gpscript.exe, wmic.exe, notepad.exe, regsvr32.exe, schtasks.exe, etc.) and flags cases where any of these processes initiate connections to internet-visible destinations. The detection is implemented as a network-centric query that aggregates by source, destination, port, protocol, and process (app) context, and excludes known internal or reserved IP ranges to focus on potentially suspicious external endpoints. The macro lolbas_rare_network_connection_filter is applied to enforce consistent filtering and enable drill-downs. The approach is designed to surface proxy execution, payload delivery, command-and-control, or abuse of trusted binaries, while acknowledging that some binaries may legitimately access certain public resources (e.g., Notepad.exe with specific services) and may generate false positives in noisy environments. Operators are advised to join this analytic with Process Execution events to provide richer context and reduce noise. The rule explicitly notes exclusions for highly noisy runtimes (PowerShell, PowerShell ISE, pwsh, and cmd.exe) and emphasizes environment-specific suppression of known benign connections. This rule is intended for endpoint-network visibility and works best with integrated alerts and risk context for rapid investigation and containment.