Sysmon Event ID 3: Network Connection — Fields and Hunting Queries

What it records

Microsoft’s description: the network connection event “logs TCP/UDP connections on the machine. It is disabled by default. Each connection is linked to a process through the ProcessId and ProcessGuid fields.” That link is the reason to collect it. A firewall or flow log shows that 10.0.5.23 talked to an address on port 443; Sysmon event 3 shows that it was rundll32.exe, running as a specific user, started by a specific parent.

Each event carries the process (Image, ProcessGuid, ProcessId, User), the direction (Initiated), the Protocol, and both ends: SourceIp, SourceHostname, SourcePort and SourcePortName, and the same four for the destination, plus SourceIsIpv6 and DestinationIsIpv6. Because it is off unless configured, what you have depends entirely on the <NetworkConnect> rules: some configurations log every connection, others only those from script hosts and unusual folders, others nothing.

When it matters

Pattern	Reading
Office, a script host (wscript.exe, mshta.exe) or rundll32.exe / regsvr32.exe connecting to a public address	Code fetching a payload or calling home (T1105, T1071)
powershell.exe with outbound connections on 80 or 443	Often a download cradle — read the command line in event 1
Many connections from one process to one address at regular intervals	Beaconing from an implant
Common tools on uncommon ports (4444, 8080 from a binary in AppData)	A non-standard port for command and control (T1571)
Initiated false on SMB (445), RDP (3389) or WinRM (5985) from another workstation	Lateral movement into this host
A process in \Temp\ or \Users\Public\ making any outbound connection	Dropped malware

How to investigate

The Event table holds Sysmon events with their fields in EventData. Outbound connections from processes that rarely need the network:

Event
| where TimeGenerated > ago(7d)
| where Source == "Microsoft-Windows-Sysmon" and EventID == 3
| extend D = parse_xml(EventData).DataItem.EventData.Data
| mv-apply d = D on (summarize f = make_bag(bag_pack(tostring(d["@Name"]), tostring(d["#text"]))))
| extend Image = tostring(f.Image), Initiated = tostring(f.Initiated), DestinationIp = tostring(f.DestinationIp),
         DestinationPort = toint(f.DestinationPort), Account = tostring(f.User)
| where Initiated == "true" and not(ipv4_is_private(DestinationIp))
| where Image has_any ("rundll32.exe", "regsvr32.exe", "mshta.exe", "wscript.exe", "cscript.exe", "winword.exe", "excel.exe", "\\AppData\\", "\\Temp\\")
| project TimeGenerated, Computer, Account, Image, DestinationIp, DestinationPort

Regular, repeated connections — a starting point for beacon hunting:

Event
| where TimeGenerated > ago(1d)
| where Source == "Microsoft-Windows-Sysmon" and EventID == 3
| extend D = parse_xml(EventData).DataItem.EventData.Data
| mv-apply d = D on (summarize f = make_bag(bag_pack(tostring(d["@Name"]), tostring(d["#text"]))))
| extend Image = tostring(f.Image), DestinationIp = tostring(f.DestinationIp), DestinationPort = toint(f.DestinationPort)
| where tostring(f.Initiated) == "true"
| summarize Connections = count(), Hours = dcount(bin(TimeGenerated, 1h)) by Computer, Image, DestinationIp, DestinationPort
| where Hours >= 12
| order by Hours desc, Connections desc

For each hit, take the ProcessGuid back to the process creation event for the command line and parent, and to the process’s DNS queries for the names it resolved. Check destination addresses with the IP blocklist checker. If a host shows no event 3 at all, read the configuration: the <NetworkConnect> section may be missing or include only a few processes.