Detection rules › Kusto Query Language

RecordedFuture Threat Hunting IP All Actors

'Recorded Future Threat Hunting IP correlation for all actors.'

MITRE ATT&CK coverage

Tactic	Techniques
Command & Control	`T1568` Dynamic Resolution
Exfiltration	`T1041` Exfiltration Over C2 Channel

Provider	Event ID	Title
Sysmon	3	Network connection
Security-Auditing	5152	The Windows Filtering Platform blocked a packet.
Security-Auditing	5154	The Windows Filtering Platform has permitted an application or service to listen on a port for incoming connections.
Security-Auditing	5155	The Windows Filtering Platform has blocked an application or service from listening on a port for incoming connections.
Security-Auditing	5156	The Windows Filtering Platform has permitted a connection.
Security-Auditing	5157	The Windows Filtering Platform has blocked a connection.
Security-Auditing	5158	The Windows Filtering Platform has permitted a bind to a local port.
Security-Auditing	5159	The Windows Filtering Platform has blocked a bind to a local port.

_Im_NetworkSession

DstIpAddr is_not_null