NetworkConnectIP4: CrowdStrike Outbound Connection Event and Queries

What it records

NetworkConnectIP4 is written when a process on a host attempts an IPv4 connection. It records both ends — LocalAddressIP4 and LocalPort, RemoteAddressIP4 and RemotePort — the IP Protocol (6 TCP, 17 UDP, 1 ICMP), and ConnectionDirection (0 outbound, 1 inbound, 2 neither, 3 both). ConnectionFlags marks raw sockets and promiscuous-mode capture, both unusual for ordinary programs. Panther documents IPv4 and IPv6 connections with one schema, which is why the IPv6 address fields also appear in the field list; NetworkConnectIP6 is the IPv6 event.

As with DNS lookups, ContextProcessId names the process: it is the TargetProcessId of that process’s ProcessRollup2 on the same host. A connection on its own says that something talked to an address; joined to the process it says which program, with which command line and user. Byte counts and whether the connection completed are not in the documented fields.

When it matters

• Command and control. Regular connections from one process to one rare external address, a script host or Office application connecting out at all, or traffic to ports that attack tools default to, such as 4444 (MITRE ATT&CK T1571). The Falcon beaconing use case shows the pattern.
• Remote access to the internet. CrowdStrike’s own example alert flags connections to ports 21, 22, 3389, 5900 and 5901 outside private ranges — an internal host opening FTP, SSH, remote desktop or VNC sessions out to the internet.
• Lateral movement. Workstations connecting to other workstations on 445, 135, 5985 or 3389 is how intruders spread; workstations rarely need to.
• Raw sockets. ConnectionFlags set on a user program points at packet crafting or capture.

How to investigate

1. Filter by the address or port of interest, and leave out private ranges when hunting outbound traffic.
2. Join to ProcessRollup2 on aid and process ID to name the program, command line and user.
3. Count hosts per remote address: one or two hosts talking to an address no one else uses is the interesting tail. CrowdStrike also publishes a query for the least common destination ports.
4. Look at the DnsRequest events of the same process to find the domain name behind the address, and check the address with the IP blocklist checker.

Remote-access ports to public addresses, from CrowdStrike’s example alert:

#event_simpleName=NetworkConnectIP4
| RemotePort=/^(21|22|3389|5900|5901)$/
| !cidr(RemoteAddressIP4, subnet=["224.0.0.0/4", "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "127.0.0.0/8", "169.254.0.0/16"])
| groupBy([aid, ComputerName, RemoteAddressIP4, RemotePort], function=count(as=Connections), limit=max)
| sort(Connections, order=desc)

The program behind connections to a port, joined the way CrowdStrike’s queries join processes and connections:

(#event_simpleName=ProcessRollup2 event_platform=Win) OR (#event_simpleName=NetworkConnectIP4 RemotePort=4444)
| falconPID := TargetProcessId | falconPID := ContextProcessId
| selfJoinFilter([aid, falconPID], where=[{#event_simpleName=ProcessRollup2}, {#event_simpleName=NetworkConnectIP4}], prefilter=true)
| groupBy([aid, falconPID], function=collect([ImageFileName, CommandLine, RemoteAddressIP4, RemotePort]))

Remote-access ports to public addresses over Falcon Data Replicator data in Splunk (add your index):

sourcetype="crowdstrike:events:sensor" event_simpleName=NetworkConnectIP4 RemotePort IN (21, 22, 3389, 5900, 5901)
| where NOT cidrmatch("10.0.0.0/8", RemoteAddressIP4) AND NOT cidrmatch("172.16.0.0/12", RemoteAddressIP4) AND NOT cidrmatch("192.168.0.0/16", RemoteAddressIP4)
| stats count AS Connections, dc(aid) AS Hosts by RemoteAddressIP4, RemotePort
| sort - Connections

The free log analyzer reads Falcon exports in the browser and flags connections to reverse-shell ports and exposed management ports.