Sysmon Event ID 3: Network connection detected
Sysmon Event ID 3 records network connections initiated by a process and links outbound activity to the responsible image, user, process GUID, and destination.
- Applicable version
- Sysmon 1.0 and later; network connection logging must be enabled
- Last reviewed
- 2026-07-10
Trigger Scenarios
Sysmon generates the event when a configured process establishes a TCP or UDP connection. The event is disabled by default in Sysmon and must be explicitly enabled in the configuration.
Key Fields
Image / ProcessGuid
The executable and stable process identifier responsible for the connection. ProcessGuid can be joined to Event ID 1 for command-line and parent-process context.
DestinationIp / DestinationHostname
The remote address and hostname observed for the connection. Compare both values because name resolution and direct-IP connections provide different investigative clues.
DestinationPort
The remote service port. Rare ports, ports that do not match the process role, and external administrative services are useful starting points.
Initiated
Indicates whether the local process initiated the connection. Most outbound command-and-control hunting focuses on initiated connections.
Common False Positives
- Browsers, endpoint agents, update clients, and cloud applications make frequent external connections.
- CDNs and shared hosting can make an unfamiliar destination appear suspicious without additional context.
- Remote administration and monitoring platforms can legitimately use uncommon ports.
Related Events
MITRE ATT&CK Mapping
- T1071Application Layer Protocol
- T1105Ingress Tool Transfer
Detection Notes
T1071/T1105 is concrete when Initiated is true, DestinationPort is 443 or 80, and Image is powershell.exe, mshta.exe, or a binary under C:\\Users\\. Join ProcessGuid to Event ID 1; periodic connections to one DestinationIp are beacon candidates.
Sysmon
| where EventID == 3 and Initiated == "true"
| where Image has_any ("\\powershell.exe", "\\rundll32.exe", "\\mshta.exe")
| project TimeGenerated, Computer, User, Image, DestinationIp, DestinationHostname, DestinationPort, ProcessGuid
| order by TimeGenerated descindex=sysmon EventCode=3 Initiated=true
| search Image IN ("*\\powershell.exe", "*\\rundll32.exe", "*\\mshta.exe")
| table _time, host, User, Image, DestinationIp, DestinationHostname, DestinationPort, ProcessGuidUtcTime: 2026-07-10 03:20:14.000
ProcessGuid: {11111111-2222-3333-4444-555555555555}
Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
User: CORP\jsmith
Protocol: tcp
Initiated: true
DestinationHostname: example.invalid
DestinationIp: 203.0.113.10
DestinationPort: 443