Defender-DeviceNetworkEvents

8 ActionTypes

ActionType	Title
any	Network activity (any)
ConnectionSuccess	Connection succeeded
ConnectionFailed	Connection failed
InboundConnectionAccepted	Inbound connection accepted
ListeningConnectionCreated	Listening connection created
ConnectionRequest	Connection request
DnsConnectionInspected	DNS connection inspected
DnsQueryResponse	DNS query / response

any: Network activity (any)

Provider: Defender-DeviceNetworkEvents
Channel: DeviceNetworkEvents

Description

Network activity (any)

Fields #

Name	Description	Rules
`DeviceId`
`Timestamp`
`ActionType`
`RemoteIP`
`RemotePort`
`RemoteUrl`
`LocalIP`
`LocalPort`
`Protocol`
`InitiatingProcessFileName`		2
`InitiatingProcessCommandLine`

Detection Patterns #

Lateral Movement: Distributed Component Object Model

Defender-DeviceNetworkEvents any: Network activityORSecurity-Auditing Event ID 5156: The Windows Filtering Platform has permitted a connection.ORSysmon Event ID 3: Network connection

1 rule

Kusto

DCOM Lateral Movement (source)

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`parent_process_name`	eq	`svchost.exe`	1 rule	elastic, kusto, splunk
`CommandLine`	contains	`commandline`	1 rule	kusto, splunk
`EventType`	ne	`ListeningConnectionCreated`	1 rule	kusto

Detection Rules #

View all rules referencing this event →

Kusto # view in coverage

Zinc Actor IOCs files - October 2022 source high: Identifies a match across filename and commandline IOC's related to an actor tracked by Microsoft as Zinc. Reference: https://www.microsoft.com/security/blog/2022/09/29/zinc-weaponizing-open-source-software/
Suspicious Network Beacons - Microsoft Defender for Endpoint Aggregated Reports source: Below query detects suspicious beaconing activity by analyzing DeviceNetworkEvents Aggregated Reports telemetry. Use it as a starting point and refine further as it may generate too many results.
Suspicious Network Connections - Supply Chain Attack source: Below query detects unusual network conenctions from servers that have 3rd party software installed.
You can further improve the query by using a list of servers that have privileges across the whole domain.

References #

Microsoft Defender XDR: advanced hunting reference https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-devicenetworkevents-table
xdrinternals: XDR table schema https://xdrinternals.com/docs/microsoftxdr/devices/devicenetworkevents/

ConnectionSuccess: Connection succeeded

Provider: Defender-DeviceNetworkEvents
Channel: ConnectionSuccess

Description

Connection succeeded

Fields #

Name	Description
`DeviceId`
`Timestamp`
`RemoteIP`
`RemotePort`
`RemoteUrl`
`Protocol`
`InitiatingProcessFileName`

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`EventType`	eq	`ConnectionSuccess`	5 rules	kusto
`DestinationPort`	eq	`9389`	2 rules	elastic, kusto, sigma, splunk
`EventType`	in	`FileCreated`	1 rule	kusto
`EventType`	in	`FileModified`	1 rule	kusto
`RemoteIPType`	eq	`Public`	1 rule	kusto
`DestinationPort`	in	`80`	1 rule	kusto, splunk
`outliers`	gt	`2`	1 rule	kusto

Detection Rules #

View all rules referencing this event →

Kusto # view in coverage

SUNBURST network beacons source medium: Identifies SolarWinds SUNBURST domain beacon IOCs in DeviceNetworkEvents References: - https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html - https://gist.github.com/olafhartong/71ffdd4cab4b6acd5cbcd1a0691ff82f
Suspicious office child process created source: This query obtains a list of downloaded Office documents (doc, xls, etc.) by looking at files written by commonly used web browsers. It then searches for invocations of an Office program by double-clicking on these files. If these processes spawn an uncommon child process this is reported as suspicious.
NTLM Relay Attack source: This query searches for successful NTLM network logins where the device name contained in the NTLM authentication message contains a device that is known to MDE, but the source IP address is different from the known source IP address for that specific device. This could indicate an attacker is relaying the NTLM authentication information. To remove false positives, this query also searches for an outgoing network connection from the initiator to the attacker.

Show 5 more (8 total)

ADWS Connection from Unexpected Binary source: This query first collects the IP addresses of all machines that have the Active Directory Web Services (ADWS) service running. It then searches for network connections to these IP addresses from processes that are not expected to connect to ADWS.
ADWS Connection from Process Injection Target source: The query first collects all network connections to the Active Directory Web Services (ADWS) service. It then searches for processes that inject into a process that makes a connection to ADWS. This can be used to detect process injection into a process that is used to query Active Directory.
Suspicious Network Beacons - Microsoft Defender(MDE/M365D) source: Below query detects suspicious beaconing activity by analyzing DeviceNetworkEvents data.
Rouge RDP: Suspicious File Creation source: Below query detects file creations of mstsc.exe where it also makes a network connection to a public IP address. This behavior is an indication of Rogue RDP.
False Positives: Copying files to the local machine over RDP may cause false positives.
Server Network Connection Anomalies source: Servers have a specific baseline. This makes it easy to create a baseline and detect anomalies.
Below queries analyze the network connections made by the specified servers and detects the rare/anomalous ones.
You can add process info to the analysis, but it will probably generate more results(different processes for the same IP).

References #

Microsoft Defender XDR: advanced hunting reference https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-devicenetworkevents-table
xdrinternals: XDR table schema https://xdrinternals.com/docs/microsoftxdr/devices/devicenetworkevents/

ConnectionFailed: Connection failed

Provider: Defender-DeviceNetworkEvents
Channel: ConnectionFailed

Description

Connection failed

Fields #

Name	Description
`DeviceId`
`Timestamp`
`RemoteIP`
`RemotePort`
`Protocol`
`InitiatingProcessFileName`

References #

Microsoft Defender XDR: advanced hunting reference https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-devicenetworkevents-table
xdrinternals: XDR table schema https://xdrinternals.com/docs/microsoftxdr/devices/devicenetworkevents/

InboundConnectionAccepted: Inbound connection accepted

Provider: Defender-DeviceNetworkEvents
Channel: InboundConnectionAccepted

Description

Inbound connection accepted

Fields #

Name	Description
`DeviceId`
`Timestamp`
`LocalIP`
`LocalPort`
`RemoteIP`
`Protocol`

Detection Patterns #

Lateral Movement: SMB/Windows Admin Shares

Defender-DeviceNetworkEvents InboundConnectionAccepted: Inbound connection acceptedORSecurity-Auditing Event ID 5156: The Windows Filtering Platform has permitted a connection.

1 rule

Kusto

SMB/Windows Admin Shares (source)

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`parent_process_name`	eq	`services.exe`	1 rule	elastic, kusto, splunk
`file_name`	in	`cmd.exe`	1 rule	kusto
`file_name`	in	`ftp.exe`	1 rule	kusto
`file_name`	in	`msiexec.exe`	1 rule	kusto
`file_name`	in	`regsvr32.exe`	1 rule	kusto
`file_name`	in	`rundll32.exe`	1 rule	kusto
`file_name`	in	`schtasks.exe`	1 rule	kusto
`file_name`	in	`agentexecutor.exe`	1 rule	kusto
`file_name`	in	`appvlp.exe`	1 rule	kusto
`file_name`	in	`at.exe`	1 rule	kusto
`file_name`	in	`atbroker.exe`	1 rule	kusto
`file_name`	in	`bash.exe`	1 rule	kusto
`file_name`	in	`bginfo.exe`	1 rule	kusto
`file_name`	in	`bitsadmin.exe`	1 rule	kusto
`file_name`	in	`cdb.exe`	1 rule	kusto

References #

Microsoft Defender XDR: advanced hunting reference https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-devicenetworkevents-table
xdrinternals: XDR table schema https://xdrinternals.com/docs/microsoftxdr/devices/devicenetworkevents/

ListeningConnectionCreated: Listening connection created

Provider: Defender-DeviceNetworkEvents
Channel: ListeningConnectionCreated

Description

Listening connection created

Fields #

Name	Description
`DeviceId`
`Timestamp`
`LocalIP`
`LocalPort`
`Protocol`
`InitiatingProcessFileName`

References #

Microsoft Defender XDR: advanced hunting reference https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-devicenetworkevents-table
xdrinternals: XDR table schema https://xdrinternals.com/docs/microsoftxdr/devices/devicenetworkevents/

ConnectionRequest: Connection request

Provider: Defender-DeviceNetworkEvents
Channel: ConnectionRequest

Description

Connection request

Fields #

Name	Description
`DeviceId`
`Timestamp`
`RemoteIP`
`RemotePort`
`Protocol`

References #

Microsoft Defender XDR: advanced hunting reference https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-devicenetworkevents-table
xdrinternals: XDR table schema https://xdrinternals.com/docs/microsoftxdr/devices/devicenetworkevents/

DnsConnectionInspected: DNS connection inspected

Provider: Defender-DeviceNetworkEvents
Channel: DnsConnectionInspected

Description

DNS connection inspected

Fields #

Name	Description
`DeviceId`
`Timestamp`
`RemoteUrl`
`RemoteIP`
`Protocol`

References #

Microsoft Defender XDR: advanced hunting reference https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-devicenetworkevents-table
xdrinternals: XDR table schema https://xdrinternals.com/docs/microsoftxdr/devices/devicenetworkevents/

DnsQueryResponse: DNS query / response

Provider: Defender-DeviceNetworkEvents
Channel: DnsQueryResponse

Description

DNS query / response

Fields #

Name	Description
`DeviceId`
`Timestamp`
`RemoteUrl`
`RemoteIP`

References #

Microsoft Defender XDR: advanced hunting reference https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-devicenetworkevents-table
xdrinternals: XDR table schema https://xdrinternals.com/docs/microsoftxdr/devices/devicenetworkevents/

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)

Defender-DeviceNetworkEvents

any: Network activity (any)

Description

Fields #

Detection Patterns #

Lateral Movement: Distributed Component Object Model

Kusto

Common Indicators #

Detection Rules #

Kusto # view in coverage

References #

ConnectionSuccess: Connection succeeded

Description

Fields #

Common Indicators #

Detection Rules #

Kusto # view in coverage

Related Events #

References #

ConnectionFailed: Connection failed

Description

Fields #

References #

InboundConnectionAccepted: Inbound connection accepted

Description

Fields #

Detection Patterns #

Lateral Movement: SMB/Windows Admin Shares

Kusto

Common Indicators #

References #

ListeningConnectionCreated: Listening connection created

Description

Fields #

References #

ConnectionRequest: Connection request

Description

Fields #

References #

DnsConnectionInspected: DNS connection inspected

Description

Fields #

References #

DnsQueryResponse: DNS query / response

Description

Fields #

References #