Detection rules › By event

Microsoft-Windows-Sysmon event 3

68 detection rules reference this event. View event page.

Sigma (51)

Communication To LocaltoNet Tunneling Service Initiated severity high T1090, T1102, T1572
Communication To Ngrok Tunneling Service Initiated severity high T1090, T1102, T1567, T1568.002, T1572
Communication To Uncommon Destination Ports severity medium T1571
Local Network Connection Initiated By Script Interpreter severity medium T1105
Microsoft Sync Center Suspicious Network Connections severity medium T1055, T1218
Network Communication Initiated To File Sharing Domains From Process Located In Suspicious Folder severity high T1105
Network Communication Initiated To Portmap.IO Domain severity medium T1041, T1090.002
Network Communication With Crypto Mining Pool severity high T1496
Network Connection Initiated By AddinUtil.EXE severity high T1218
Network Connection Initiated By Eqnedt32.EXE severity high T1203
Network Connection Initiated By IMEWDBLD.EXE severity high T1105
Network Connection Initiated By Regsvr32.EXE severity medium T1218.010, T1559.001
Network Connection Initiated From Process Located In Potentially Suspicious Or Uncommon Location severity high T1105
Network Connection Initiated To AzureWebsites.NET By Non-Browser Process severity medium T1102, T1102.001
Network Connection Initiated To BTunnels Domains severity medium T1567, T1572
Network Connection Initiated To Cloudflared Tunnels Domains severity medium T1567, T1572
Network Connection Initiated To DevTunnels Domain severity medium T1567.001, T1572
Network Connection Initiated To Mega.nz severity low T1567.002
Network Connection Initiated To Visual Studio Code Tunnels Domain severity medium T1567, T1572
Network Connection Initiated via Finger.EXE severity high T1059.003, T1071.004
Network Connection Initiated Via Notepad.EXE severity high T1055
New Connection Initiated To Potential Dead Drop Resolver Domain severity high T1102, T1102.001
Office Application Initiated Network Connection Over Uncommon Ports severity medium
Office Application Initiated Network Connection To Non-Local IP severity medium T1203
Outbound Network Connection Initiated By Cmstp.EXE severity high T1218.003
Outbound Network Connection Initiated By Microsoft Dialer severity high T1071.001
Outbound Network Connection Initiated By Script Interpreter severity high T1105
Outbound Network Connection To Public IP Via Winlogon severity medium T1218.011
Outbound RDP Connections Over Non-Standard Tools severity high T1021.001
Potential Remote PowerShell Session Initiated severity high T1021.006, T1059.001
Potentially Suspicious Malware Callback Communication severity high T1571
Potentially Suspicious Network Connection To Notion API severity low T1102
Potentially Suspicious Wuauclt Network Connection severity medium T1218
Process Initiated Network Connection To Ngrok Domain severity high T1102, T1567, T1572
Python Initiated Connection severity medium T1046
RDP Over Reverse SSH Tunnel severity high T1021.001, T1572
RDP to HTTP or HTTPS Target Ports severity high T1021.001, T1572
RegAsm.EXE Initiating Network Connection To Public IP severity medium T1218.009
Remote Access Tool - AnyDesk Incoming Connection severity medium T1219.002
Rundll32 Internet Connection severity medium T1218.011
Silenttrinity Stager Msbuild Activity severity high T1127.001
Suspicious Dropbox API Usage severity high T1105, T1567.002
Suspicious Network Connection Binary No CommandLine severity high
Suspicious Network Connection to IP Lookup Service APIs severity medium T1016
Suspicious Non-Browser Network Communication With Google API severity medium T1102
Suspicious Non-Browser Network Communication With Telegram API severity medium T1102, T1105, T1567
Suspicious Outbound SMTP Connections severity medium T1048.003
Suspicious Wordpad Outbound Connections severity medium
Uncommon Connection to Active Directory Web Services severity medium T1087
Uncommon Network Connection Initiated By Certutil.EXE severity high T1105
Uncommon Outbound Kerberos Connection severity medium T1550.003, T1558

Microsoft-Windows-Sysmon event 3

Sigma (51)

Splunk (17)

Keyboard Shortcuts