Sysmon Event ID 3: Network connection
Records TCP and UDP connections with the process that made them.
- Log
- Microsoft-Windows-Sysmon/Operational
- Category
- Network
Why it matters
- Shows which process talked to which IP and port, for example rundll32 or PowerShell connecting out to the internet.
What to check
Check Image, DestinationIp, DestinationPort, DestinationHostname and the user.
How to turn it on
Sysmon configuration including NetworkConnect (off in the default config).
MITRE ATT&CK
- T1105 Ingress Tool Transfer