Event 3: Network Connection

What This Event Means

Sysmon Event 3 captures every network connection made by processes on the monitored system, providing visibility into outbound and inbound communications that native Windows logging doesn't offer. This event records the initiating process name and ID, the source and destination IP addresses and ports, protocol (TCP or UDP), and whether the connection was initiated or received. This detailed network telemetry enables security analysts to detect malware beaconing to command-and-control servers, identify data exfiltration attempts, monitor lateral movement across the network, and discover unauthorized network services running on endpoints. The combination of process-level attribution with network connection details is powerful for threat hunting - you can see exactly which executable is communicating with external infrastructure or internal systems. For instance, when a document viewer like Adobe Reader suddenly initiates network connections to unknown IP addresses, it likely indicates exploitation or embedded malware. The event is invaluable for detecting living-off-the-land techniques where legitimate system utilities like PowerShell, certutil, or bitsadmin are abused to communicate with attacker infrastructure. By correlating Event 3 with process creation (Event 1) and file creation (Event 11), analysts can trace the complete attack lifecycle from initial execution through network communication to file system changes. Advanced threat hunters use Event 3 to identify beaconing patterns characteristic of specific malware families, detect DNS tunneling through unusual port 53 traffic patterns, and spot data exfiltration through large uploads to cloud storage services or unknown destinations.

Security Implications

• Connections to known malicious IPs or suspicious foreign countries from business applications indicate compromise
• Document viewers or Office applications making network connections suggest exploitation or malicious macros
• Regular beaconing patterns (connections every N seconds/minutes) reveal command-and-control communication
• Connections from PowerShell or scripting engines to internet IPs show malware or attacker activity
• Internal lateral movement via SMB (port 445) or RDP (port 3389) from user workstations indicates spreading

Detection Strategies

Implement network connection baselining to understand normal communication patterns for applications in your environment. Alert on network connections from unusual processes, especially document viewers, media players, or other applications that shouldn't initiate connections. Integrate threat intelligence feeds to automatically flag connections to known malicious IPs, domains, and infrastructure. Monitor for beaconing behavior by analyzing connection frequency and regularity, particularly connections that occur at precise intervals characteristic of automated malware callbacks. Detect data exfiltration by tracking upload volume from client systems to external destinations, especially large transfers to newly observed domains. Flag internal lateral movement by monitoring for workstation-to-workstation connections on administrative ports like 135, 139, 445, 3389. Correlate network connections with process execution to identify which parent process spawned the communicating executable. Detailed Sysmon configuration recommendations and SIEM detection rules will be added in upcoming releases.

Real-World Attack Examples

• TrickBot malware generates distinctive Sysmon Event 3 patterns with connections to numerous C2 servers for redundancy

• APT29 (Cozy Bear) campaigns show specific beaconing patterns in Event 3 logs, connecting to compromised websites every 10-30 minutes

• Ransomware exfiltration visible in Event 3 as large outbound transfers from victim systems to attacker-controlled storage before encryption

Related Events