Detection rules › Kusto Query Language

Google Threat Intelligence - Threat Hunting IP

'Google Threat Intelligence IP correlation.'

MITRE ATT&CK coverage

Tactic	Techniques
Command & Control	`T1071` Application Layer Protocol

Provider	Event ID	Title
Sysmon	3	Network connection
Security-Auditing	5152	The Windows Filtering Platform blocked a packet.
Security-Auditing	5154	The Windows Filtering Platform has permitted an application or service to listen on a port for incoming connections.
Security-Auditing	5155	The Windows Filtering Platform has blocked an application or service from listening on a port for incoming connections.
Security-Auditing	5156	The Windows Filtering Platform has permitted a connection.
Security-Auditing	5157	The Windows Filtering Platform has blocked a connection.
Security-Auditing	5158	The Windows Filtering Platform has permitted a bind to a local port.
Security-Auditing	5159	The Windows Filtering Platform has blocked a bind to a local port.

_Im_NetworkSession

DstIpAddr is_not_null