Anomalous encrypted traffic detected from an internal host to an external IP, indicating a potential command and control setup. The communication was observed using TLS over non-standard ports, which is a common tactic to evade detection.