Sysmon Event ID 3: Network connection detected (C2 hunting)
Sysmon Event ID 3 logs each TCP/UDP connection with the process that made it. Fields explained, how to spot beaconing and LOLBin traffic, and how to tame the noise.
Sysmon Event ID 3 logs each TCP/UDP connection with the process that made it. Fields explained, how to spot beaconing and LOLBin traffic, and how to tame the noise.