Defensive Cyber Academy

Theme

win:sysmon 3

Network connection

The network connection event logs TCP/UDP connections on the machine.

Log source: Sysmon
Host type: Windows (workstation, member server, domain controller)
How to enable: Install Sysmon with a configuration that includes the matching rule group; see sysmon-modular for an ATT&CK-mapped configuration.
Tier, host type: Minimum
Techniques: 130
Rules depending on it: Splunk 24, Sigma 61, Elastic 37, Microsoft Sentinel 5

Why this tier

By role

Role	Tier	Basis
Windows workstation	Minimum
Windows member server	Minimum
Windows domain controller	Minimum
Windows web server (IIS), internet-facing	Minimum

Techniques it helps detect

Rules that depend on it

Splunk 24

Sigma 61

Communication To LocaltoNet Tunneling Service Initiated by Andreas Braathen (mnemonic.io)
Communication To Ngrok Tunneling Service Initiated by Florian Roth (Nextron Systems)
Communication To Uncommon Destination Ports by Florian Roth (Nextron Systems)
Dfsvc.EXE Initiated Network Connection Over Uncommon Port by Nasreddine Bencherchali (Nextron Systems)
Dfsvc.EXE Network Connection To Non-Local IPs by Nasreddine Bencherchali (Nextron Systems)
Dllhost.EXE Initiated Network Connection To Non-Local IP Address by bartblaze
HH.EXE Initiated HTTP Network Connection by Nasreddine Bencherchali (Nextron Systems)
Local Network Connection Initiated By Script Interpreter by frack113
Microsoft Sync Center Suspicious Network Connections by elhoim
Msiexec.EXE Initiated Network Connection Over HTTP by frack113
Network Communication Initiated To File Sharing Domains From Process Located In Suspicious Folder by Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
Network Communication Initiated To Portmap.IO Domain by Florian Roth (Nextron Systems)
Network Communication With Crypto Mining Pool by Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
Network Connection Initiated By AddinUtil.EXE by Michael McKinley (@McKinleyMike), Tony Latteri (@TheLatteri)
Network Connection Initiated By Eqnedt32.EXE by Max Altgelt (Nextron Systems)
Network Connection Initiated By IMEWDBLD.EXE by frack113
Network Connection Initiated By PowerShell Process by Florian Roth (Nextron Systems)
Network Connection Initiated By Regsvr32.EXE by Dmitriy Lifanov, oscd.community
Network Connection Initiated From Process Located In Potentially Suspicious Or Uncommon Location by Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
Network Connection Initiated From Users\Public Folder by Florian Roth (Nextron Systems)
Network Connection Initiated To AzureWebsites.NET By Non-Browser Process by Nasreddine Bencherchali (Nextron Systems)
Network Connection Initiated To BTunnels Domains by Kamran Saifullah
Network Connection Initiated To Cloudflared Tunnels Domains by Kamran Saifullah, Nasreddine Bencherchali (Nextron Systems)
Network Connection Initiated To DevTunnels Domain by Kamran Saifullah
Network Connection Initiated To Mega.nz by Florian Roth (Nextron Systems)
Network Connection Initiated To Visual Studio Code Tunnels Domain by Kamran Saifullah
Network Connection Initiated Via Notepad.EXE by EagleEye Team
Network Connection Initiated via Finger.EXE by Swachchhanda Shrawan Poudel (Nextron Systems)
New Connection Initiated To Potential Dead Drop Resolver Domain by Sorina Ionescu, X__Junior (Nextron Systems)
Office Application Initiated Network Connection Over Uncommon Ports by X__Junior (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
Office Application Initiated Network Connection To Non-Local IP by Christopher Peacock '@securepeacock', SCYTHE '@scythe_io', Florian Roth (Nextron Systems), Tim Shelton, Nasreddine Bencherchali (Nextron Systems)
Outbound Network Connection Initiated By Cmstp.EXE by Nasreddine Bencherchali (Nextron Systems)
Outbound Network Connection Initiated By Microsoft Dialer by CertainlyP
Outbound Network Connection Initiated By Script Interpreter by frack113, Florian Roth (Nextron Systems)
Outbound Network Connection To Public IP Via Winlogon by Christopher Peacock @securepeacock, SCYTHE @scythe_io
Outbound RDP Connections Over Non-Standard Tools by Markus Neis
Potential Compromised 3CXDesktopApp Beaconing Activity - Netcon by Nasreddine Bencherchali (Nextron Systems)
Potential Pikabot C2 Activity by Andreas Braathen (mnemonic.io)
Potential Remote PowerShell Session Initiated by Roberto Rodriguez @Cyb3rWard0g
Potentially Suspicious Azure Front Door Connection by Isaac Dunham
Potentially Suspicious Malware Callback Communication by Florian Roth (Nextron Systems)
Potentially Suspicious Network Connection To Notion API by Gavin Knapp
Potentially Suspicious Wuauclt Network Connection by Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
Process Initiated Network Connection To Ngrok Domain by Florian Roth (Nextron Systems)
Python Initiated Connection by frack113
RDP Over Reverse SSH Tunnel by Samir Bousseaden
RDP to HTTP or HTTPS Target Ports by Florian Roth (Nextron Systems)
RegAsm.EXE Initiating Network Connection To Public IP by frack113
Remote Access Tool - AnyDesk Incoming Connection by @d4ns4n_ (Wuerth-Phoenix)
Rundll32 Internet Connection by Florian Roth (Nextron Systems)
Silenttrinity Stager Msbuild Activity by Kiran kumar s, oscd.community
Suspicious Dropbox API Usage by Florian Roth (Nextron Systems)
Suspicious Network Connection Binary No CommandLine by Florian Roth (Nextron Systems)
Suspicious Network Connection to IP Lookup Service APIs by Janantha Marasinghe, Nasreddine Bencherchali (Nextron Systems)
Suspicious Non-Browser Network Communication With Google API by Gavin Knapp
Suspicious Non-Browser Network Communication With Telegram API by Nasreddine Bencherchali (Nextron Systems)
Suspicious Outbound SMTP Connections by frack113
Suspicious Wordpad Outbound Connections by X__Junior (Nextron Systems)
Uncommon Connection to Active Directory Web Services by @kostastsale
Uncommon Network Connection Initiated By Certutil.EXE by frack113, Florian Roth (Nextron Systems)
Uncommon Outbound Kerberos Connection by Ilyas Ochkov, oscd.community

Elastic 37

Connection to Common Large Language Model Endpointsinferred
Connection to Commonly Abused Free SSL Certificate Providersinferred
First Time Seen DNS Query to RMM Domaininferred
GenAI Process Connection to Suspicious Top Level Domaininferred
GenAI Process Performing Encoding/Chunking Prior to Network Activityinferred
Incoming DCOM Lateral Movement via MSHTAinferred
Incoming DCOM Lateral Movement with MMCinferred
Incoming DCOM Lateral Movement with ShellBrowserWindow or ShellWindowsinferred
Incoming Execution via PowerShell Remotinginferred
Incoming Execution via WinRM Remote Shellinferred
InstallUtil Process Making Network Connectionsinferred
Mshta Making Network Connectionsinferred
MsiExec Service Child Process With Network Connectioninferred
Network Activity to a Suspicious Top Level Domaininferred
Network Connection via Certutilinferred
Network Connection via Compiled HTML Fileinferred
Network Connection via MsXslinferred
Network Connection via Registration Utilityinferred
Network Connection via Signed Binaryinferred
Outbound Scheduled Task Activity via PowerShellinferred
Potential DNS Exfiltration via Excessive Chunked Queriesinferred
Potential Kerberos SPN Spoofing via Suspicious DNS Queryinferred
Potential Windows Error Manager Masqueradinginferred
PsExec Network Connectioninferred
Rare SMB Connection to the Internetinferred
Remote File Download via Script Interpreterinferred
Remote Scheduled Task Creationinferred
Remotely Started Services via RPCinferred
Service Command Lateral Movementinferred
Suspicious Command Prompt Network Connectioninferred
Suspicious Kerberos Authentication Ticket Requestinferred
System Public IP Discovery via DNS Queryinferred
Unusual Network Activity from a Windows System Binaryinferred
Unusual Network Connection via DllHostinferred
Unusual Network Connection via RunDLL32inferred
Unusual Process Network Connectioninferred
WMI Incoming Lateral Movementinferred

Microsoft Sentinel 5

Standards and guidance naming it

Requirement	Relation	Basis
OMB M-26-14: Network source and destinationAppendix B item 5(2)	Supports an activity	our analysis: Sysmon 3 records process-attributed network connections
OMB M-26-14: Indicators of compromiseAppendix B item 5(7)	Supports an activity	our analysis: destination IPs by process
OMB M-26-14: Attack vectors and lateral movementAppendix B item 5(10)	Supports an activity	our analysis: connections between hosts

EDR events that stand in for it

Full: the sensor event carries what this event carries. Partial: the sensor reports a subset, so it does not replace the event.

Product	Sensor event	Fidelity	Basis
CrowdStrike Falcon sensor telemetry (FDR event_simpleName)	NetworkConnectIP4	Full	pySigma-backend-crowdstrike: network_connection -> NetworkConnectIP4 (outbound), NetworkReceiveAcceptIP4 (inbound)
CrowdStrike Falcon sensor telemetry (FDR event_simpleName)	NetworkConnectIP6	Full	pySigma-backend-crowdstrike: network_connection -> NetworkConnectIP4 (outbound), NetworkReceiveAcceptIP4 (inbound)
CrowdStrike Falcon sensor telemetry (FDR event_simpleName)	NetworkReceiveAcceptIP4	Full	pySigma-backend-crowdstrike: network_connection -> NetworkConnectIP4 (outbound), NetworkReceiveAcceptIP4 (inbound)
CrowdStrike Falcon sensor telemetry (FDR event_simpleName)	NetworkReceiveAcceptIP6	Full	pySigma-backend-crowdstrike: network_connection -> NetworkConnectIP4 (outbound), NetworkReceiveAcceptIP4 (inbound)
Microsoft Defender for Endpoint device tables	DeviceNetworkEvents	Full	pySigma-backend-kusto: network_connection, Sysmon EventID 3 -> DeviceNetworkEvents table
Elastic Defend endpoint events	network	Full	Elastic Defend network dataset