Question: suppose the machine is clean of all malware but not in any sense updated, patched, secured etc. Suppose I connect it to the internet from behind wireless router with the intent of using it only on a few trusted sites and only there. Or, for the sake of argument, maybe I wouldn't do any browsing at all, just let it sit there connected to the network. This is all happening in a residential situation with cable internet.

In this situation can a remote attacker somehow detect the fact that the machine is connected to the internet and try connecting to do an exploit?

Answer: 
It is hard to speculate, but let me try. You are asking:

> 
> In this situation can a remote attacker somehow detect the fact that the machine is connected to the internet and try connecting to do an exploit?
> 
> 
> 

Even if the unpatched machine is clean (how do you know? did you do clean install?) it could be compromised again. It would be hard to detect the unpatched machine directly, if it just sits and does nothing (this is not the case if it transmits/receives some traffic). But that doesn't mean that the machine is safe.

Here is a potential scenario in which the unpatched machine can be compromised: If there is a router exploit (it has [happened](http://www.pcworld.com/businesscenter/article/186996/dlink_issues_fixes_for_router_vulnerabilities.html) [before](http://isc.sans.edu/diary.html?storyid=6853)) an attacker could compromise the router and the unpatched machine is an easy target.

Another scenario: a weak encryption or weak password of the wireless router could result in router compromise, and from there the unpatched machine could be compromised too.

And last but not least -- an obvious scenario which was already mentioned: a compromised machine on the local network could result in compromise of the unpatched machine.

As for visiting trusted sites, there were cases in which third-party ads on such sites were [infecting users with malware](http://www.theregister.co.uk/2011/03/25/spotify_malvertisement_attack/), so the machine could be compromised unless Adblock Plus and/or NoScript, or similar are used (but that's part of securing the machine)

Of course these scenarios are not very easy or common, but are possible and have happened before.

There is really no reason to keep an unpatched machine on a network for a long time, behind a router or not.
Today's malware often is a delivery mechanism for a multi-pronged attack that looks for program/os vulnerabilities, service vulnerabilities, share points, etc. From the initial machine infection, it can try to push infection agents to either actively or passively attack other machines on the network through various vulnerabilities.

In your scenario, it is more likely that someone will infect another system that then attacks the vulnerable system. If the infection is a remote access trojan, the person can also actively see all the machines on the internal network. Other malware can also do a network scan and phone home with information.

On an internal windows network where file sharing is being used, an unpatched machine can be attacked through three separate vectors. 

1)Share points that have the trojan dropped in place with an autoplay. Your machine is infected either by direct execution or an autoplay being triggered. Don't enable the Microsoft Client to access other computers on the network on the outdated system.

2)Vulnerable services can be scanned for and the machine attacked through them. Don't run any services that listen on the network on the outdated system.

3)There's no such thing as a trusted website anymore. Most of your attacks will come through Acrobat files, Flash content, Java applets, etc. The browser itself, being unpatched if IE will be another major source of attack, especially if it's IE6. Keep the websites you visit down to corporate sites that have a lot to lose if they ever get compromised. Blogs are never trustworthy, you can't depend on the person running them to be aware enough to patch before compromise. I've gotten pretty used to the Kaspersky pig squeal in the last year.

Now from the most likely attack to the less likely attack.

As to "Behind a wireless router", what encryption level are you running? If you aren't running WPA2-AES, get a router that will run it and [passphrase](https://xkcd.com/936/) protect the network so that it's easy to connect other systems, but hard to break from the outside.

With NAT on the router and the unpatched computer accessing the network, all an attacker should see when this computer is generating traffic is your router IP address and a port number. Don't port forward anything to this system.

And now where NAT can allow information leaks. Whether this is Linux, Windows or MAC, there are certain intranet protocols that MUST BE BLOCKED from passing through the router to the public network. I've seen routers pass Microsoft File and Print sharing traffic outbound, DNS traffic from internal name resolution that gets passed outbound. From this traffic and a packet sniffer, it is possible to build an internal network map of the private network addresses being used and by the packets, attempt to fingerprint the OS generating them if that information isn't spelled outright in the packet.