The first time an app tries to connect, you see who made it, where it's going and on which port. Click Allow or Block, for the whole app or just one address, host or domain, and keep it forever or only until the app quits.
Windows' own components are allowed automatically, so you're only asked about the apps you installed, not about hundreds of system services.
A program only counts as Windows if it lives in a Windows folder, is owned by the system and carries a valid Microsoft Windows signature. Copying malware into System32 doesn't get it a free pass.
Malware loves PowerShell, curl, certutil, mshta and rundll32 for downloading payloads. PacketHound still asks before those connect, even though they're part of Windows.
