3 Sysmon log · Network Connection medium severity very-high volume

Sysmon Event ID 3 — Network connection detected

Network connection initiated by a process. Image, DestinationIp, DestinationPort, DestinationHostname, SourceIp, Protocol, Initiated are key.

Why event 3 matters

C2 beaconing detection — regular interval connections from unexpected processes. Data exfiltration — large data transfers to external IPs. Lateral movement — connections from workstations to SMB/RDP/WMI ports on other internal hosts. Unusual ports (DNS tunneling on 53, C2 over HTTPS on 443 from cmd.exe).

How to detect it

Alert: cmd.exe, PowerShell, mshta making external connections. Alert: internal hosts connecting to many other hosts on 445 (lateral movement scanning). Alert: regular interval connections from unknown processes (beaconing). Correlate DestinationIp with threat intel feeds.

Log source
Microsoft-Windows-Sysmon/Operational
Requires Sysmon installed with a config that logs this event (e.g. SwiftOnSecurity / Olaf Hartong).
Fields to pivot on
ImageSourceIpDestinationIpDestinationPortProtocol

MITRE ATT&CK mapping

Tactic Technique
Command and Control Application Layer Protocol (T1071)
Lateral Movement Remote Services (T1021)

Detection queries

Starting points — adapt the log source, projected fields and thresholds for your environment.

Sigma rule
title: Suspicious Process Making Outbound Connection
status: experimental
description: Unexpected process initiating external network connection
author: theadminstack.com
date: 2026/05/16
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        Initiated: 'true'
        Image|endswith:
            - '\\cmd.exe'
            - '\\powershell.exe'
            - '\\mshta.exe'
            - '\\wscript.exe'
            - '\\cscript.exe'
    filter_local:
        DestinationIp|startswith:
            - '10.'
            - '172.16.'
            - '192.168.'
    condition: selection and not filter_local
falsepositives:
    - Legitimate admin scripts
level: high
tags:
    - attack.command_and_control
    - attack.t1071
Sentinel / Defender KQL
Event
| where EventLog == "Microsoft-Windows-Sysmon/Operational" and EventID == 3   // Network connection detected
// EventData holds: Image, SourceIp, DestinationIp, DestinationPort, Protocol
| project TimeGenerated, Computer, RenderedDescription
| sort by TimeGenerated desc
Splunk SPL
index=* sourcetype="WinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=3
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count   `# Network connection detected — add EventData fields: Image, SourceIp, DestinationIp, DestinationPort`
Hunt event 3 in Sentinel/Defender →
Build a KQL query for this event in the KQL Query Builder.
Search all event IDs →
Open the interactive Windows Event ID lookup.

Frequently asked questions

What is Sysmon Event ID 3?

Network connection detected. Network connection initiated by a process. Image, DestinationIp, DestinationPort, DestinationHostname, SourceIp, Protocol, Initiated are key.

Which log records event 3?

Event 3 is written to the Microsoft-Windows-Sysmon/Operational channel by Microsoft-Windows-Sysmon. Requires Sysmon installed with a config that logs this event (e.g. SwiftOnSecurity / Olaf Hartong).

What MITRE ATT&CK techniques map to event 3?

Event 3 is associated with: Application Layer Protocol (T1071), Remote Services (T1021).

How do you detect activity around event 3?

Alert: cmd.exe, PowerShell, mshta making external connections. Alert: internal hosts connecting to many other hosts on 445 (lateral movement scanning). Alert: regular interval connections from unknown processes (beaconing). Correlate DestinationIp with threat intel feeds.