Sysmon Event ID 3: network connection
What Sysmon Event ID 3 (network connection) means, the fields to check, what is normal and what is suspicious, with PowerShell and KQL queries to find it.
Sysmon Event ID 3 records network connections and, crucially, the process that made them. A firewall log tells you a host talked to an IP; Sysmon 3 tells you it was rundll32.exe that did. Because it is noisy, most configurations drop common browsers and system services and keep the rest.
The fields that matter
| Field | What it tells you |
|---|---|
| Image | The program that opened the connection. |
| User | The account it ran as. |
| Initiated | true for an outbound connection, false for inbound. |
| DestinationIp / DestinationHostname / DestinationPort | Where it went. Check the IP against threat intelligence. |
| SourceIp / SourcePort | The local side of the connection. |
What is normal
Browsers, update services, Office talking to Microsoft, and agents talking to their own cloud services.
When Sysmon Event ID 3 is suspicious
rundll32.exe,regsvr32.exe,mshta.exe,wscript.exeornotepad.execonnecting to the internet.- PowerShell connecting to a raw IP address, or to a domain registered days ago.
- Office applications connecting to anything other than Microsoft right after a document opened.
- Regular connections every few seconds or minutes from one process to one destination: beaconing.
- Outbound connections on 4444, 1337, 8443 or SMB (445) to the internet.
Common false positive: Software updaters and telemetry components run from unusual folders and call out often. Check the signature and destination owner before treating it as beaconing.
Find Sysmon Event ID 3 with PowerShell
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-Sysmon/Operational'; Id=3; StartTime=(Get-Date).AddDays(-7)} -MaxEvents 50 |
ForEach-Object {
$d = [ordered]@{ Time = $_.TimeCreated; Computer = $_.MachineName }
([xml]$_.ToXml()).Event.EventData.Data | ForEach-Object { $d[$_.Name] = $_.'#text' }
[pscustomobject]$d
} | Format-ListMicrosoft Sentinel (KQL)
Event
| where TimeGenerated > ago(7d) and Source == "Microsoft-Windows-Sysmon" and EventID == 3
| project TimeGenerated, Computer, RenderedDescription, EventData
| order by TimeGenerated descRelated events
- Sysmon Event ID 22: DNS query
- Sysmon Event ID 1: process creation
- Event ID 5156: Windows Filtering Platform allowed a connection
For a full walk-through, read How to investigate a suspicious IP address.
FAQ
Why don't I see Sysmon Event ID 3?
Many Sysmon configurations turn network logging off or include only selected processes. Check the NetworkConnect section of your config.
How do I check a destination IP quickly?
Look it up in AbuseIPDB, GreyNoise and VirusTotal. IOC Triage checks an IP against those and more with a right-click.
Windows Event Triage reads a CSV, EVTX-to-JSON or XML export in your browser and flags brute force, new admins, suspicious services and log clearing.
IOC Triage, our free browser extension: right-click it for a verdict from 15 threat-intel sources, then copy a ready ticket note.