DeviceNetworkEvents

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Tables Index

Network connection and related events

Attribute Value
Category MDE
Basic Logs Eligible ✓ Yes (source)
Supports Transformations ✓ Yes (source)
Ingestion API Supported ✗ No
Lake-Only Ingestion ✓ Yes
Azure Monitor Tables Reference View Documentation
Defender XDR Advanced Hunting Schema View Documentation

Contents

Schema (51 columns)

Source: Azure Monitor documentation

Column Name Type Description
_BilledSize real The record size in bytes
_IsBillable string Specifies whether ingesting the data is billable. When _IsBillable isfalseingestion isn't billed to your Azure account
ActionType string Type of activity that triggered the event.
AdditionalFields dynamic Additional information about the entity or event.
AppGuardContainerId string Identifier for the virtualized container used by Application Guard to isolate browser activity.
DeviceId string Unique identifier for the device in the service.
DeviceName string Fully qualified domain name (FQDN) of the device.
InitiatingProcessAccountDomain string Domain of the account that ran the initiating process.
InitiatingProcessAccountName string User name of the account that ran the initiating process.
InitiatingProcessAccountObjectId string Azure AD object ID of the user account that ran the initiating process.
InitiatingProcessAccountSid string Security Identifier (SID) of the account that ran the initiating process.
InitiatingProcessAccountUpn string User principal name (UPN) of the account that ran the initiating process.
InitiatingProcessCommandLine string Command line used to run the initiating process.
InitiatingProcessCreationTime datetime Date and time when the process that initiated the event was started.
InitiatingProcessFileName string Name of the initiating process.
InitiatingProcessFileSize long Size of the file (bytes) that ran the process responsible for the event.
InitiatingProcessFolderPath string Folder containing the initiating process (image file).
InitiatingProcessId long Process ID (PID) of the initiating process.
InitiatingProcessIntegrityLevel string Integrity level of the initiating process. Windows assigns integrity levels to processes based on certain characteristics, such as if they were launched from an internet download. These integrity levels influence permissions to resources..
InitiatingProcessMD5 string MD5 hash of the initiating process (image file).
InitiatingProcessParentCreationTime datetime Date and time when the parent of the process responsible for the event was started.
InitiatingProcessParentFileName string Name of the parent process that spawned the initiating process.
InitiatingProcessParentId long Process ID (PID) of the parent process that spawned the initiating process.
InitiatingProcessRemoteSessionDeviceName string Device name of the remote device from which the initiating process's RDP session was initiated.
InitiatingProcessRemoteSessionIP string IP address of the remote device from which the initiating process's RDP session was initiated.
InitiatingProcessSessionId long Windows session ID of the initiating process.
InitiatingProcessSHA1 string SHA-1 hash of the initiating process (image file).
InitiatingProcessSHA256 string SHA-256 hash of the initiating process (image file). In some cases this column may not be populated - please use the InitiatingProcessSHA1 column instead.
InitiatingProcessTokenElevation string Token type indicating the presence or absence of User Access Control (UAC) privilege elevation applied to the initiating process.
InitiatingProcessUniqueId string Unique identifier of the initiating process; this is equal to the Process Start Key in Windows devices.
InitiatingProcessVersionInfoCompanyName string The company name in version information (image file) responsible for the event.
InitiatingProcessVersionInfoFileDescription string The description in version information (image file) responsible for the event.
InitiatingProcessVersionInfoInternalFileName string The internal file name in version information (image file) responsible for the event.
InitiatingProcessVersionInfoOriginalFileName string The original file name in version information (image file) responsible for the event.
InitiatingProcessVersionInfoProductName string The product name in version information (image file) responsible for the event.
InitiatingProcessVersionInfoProductVersion string The product version in version information (image file) responsible for the event.
IsInitiatingProcessRemoteSession bool Indicates whether the initiating process was run under a remote desktop protocol (RDP) session (true) or locally (false).
LocalIP string IP address assigned to the local machine used during communication.
LocalIPType string Type of IP address, for example Public, Private, Reserved, Loopback, Teredo, FourToSixMapping, and Broadcast.
LocalPort int TCP port on the local machine used during communication.
MachineGroup string Machine group of the machine. This group is used by role-based access control to determine access to the machine.
Protocol string IP protocol used, whether TCP or UDP.
RemoteIP string IP address that was being connected to.
RemoteIPType string Type of IP address, for example Public, Private, Reserved, Loopback, Teredo, FourToSixMapping, and Broadcast.
RemotePort int TCP port on the remote device that was being connected to.
RemoteUrl string URL or fully qualified domain name (FQDN) that was being connected to.
ReportId long Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the ComputerName and EventTime columns..
SourceSystem string The type of agent the event was collected by. For example,OpsManagerfor Windows agent, either direct connect or Operations Manager,Linuxfor all Linux agents, orAzurefor Azure Diagnostics
TenantId string The Log Analytics workspace ID
TimeGenerated datetime Date and time the event was recorded by the MDE agent on the endpoint.
Type string The name of the table

Schema References

Official Microsoft Learn documentation for field/column information:

Solutions (13)

This table is used by the following solutions:

Connectors (1)

This table is ingested by the following connectors:

Connector Selection Criteria
Microsoft Defender XDR

Content Items Using This Table (164)

Analytic Rules (20)

In solution Apache Log4j Vulnerability Detection: ActionType == "InboundConnectionAccepted"

Analytic Rule
Log4j vulnerability exploit aka Log4Shell IP IOC

In solution FalconFriday:

Analytic Rule Selection Criteria
DCOM Lateral Movement
SMB/Windows Admin Shares

In solution Microsoft Defender XDR:

Analytic Rule Selection Criteria
Execution of software vulnerable to webp buffer overflow of CVE-2023-4863
Rare Process as a Service
Regsvr32 Rundll32 Image Loads Abnormal Extension RemoteIPType == "Public"
Regsvr32 Rundll32 with Anomalous Parent Process RemoteIPType == "Public"
SUNBURST network beacons ActionType == "ConnectionSuccess"

In solution Threat Intelligence: ActionType !has "ConnectionFailed"

Analytic Rule
TI Map Domain Entity to DeviceNetworkEvents
TI Map IP Entity to DeviceNetworkEvents
TI Map URL Entity to DeviceNetworkEvents

In solution Threat Intelligence (NEW): ActionType !has "ConnectionFailed"

Analytic Rule
TI Map Domain Entity to DeviceNetworkEvents
TI Map IP Entity to DeviceNetworkEvents
TI Map URL Entity to DeviceNetworkEvents

In solution Zinc Open Source:

Analytic Rule Selection Criteria
Zinc Actor IOCs files - October 2022
[Deprecated] - Zinc Actor IOCs domains hashes IPs and useragent - October 2022

Standalone Content:

Analytic Rule Selection Criteria
Europium - Hash and IP IOCs - September 2022
IP address of Windows host encoded in web request
Mercury - Domain, Hash and IP IOCs - August 2022
Star Blizzard C2 Domains August 2022

Hunting Queries (135)

In solution Apache Log4j Vulnerability Detection:

Hunting Query Selection Criteria
Malicious Connection to LDAP port for CVE-2021-44228 vulnerability

In solution Cyware:

Hunting Query Selection Criteria
Detecting Suspicious PowerShell Command Executions

In solution Endpoint Threat Protection Essentials: InitiatingProcessFileName has "curl"

Hunting Query
Download of New File Using Curl

In solution Microsoft Defender XDR:

Hunting Query Selection Criteria
Detect MaiSniper
Rare Process as a Service
Recon with Rundll InitiatingProcessCommandLine has "rundll32.exe"
InitiatingProcessFileName == "rundll32.exe"
Regsvr32 Rundll32 Image Loads Abnormal Extension RemoteIPType == "Public"
Regsvr32 Rundll32 with Anomalous Parent Process RemoteIPType == "Public"
Snip3 Malicious Network Connectivity InitiatingProcessCommandLine == "\"
InitiatingProcessFileName in "InstallUtil.exe,RegAsm.exe,RegSvcs.exe"
InitiatingProcessParentFileName endswith "powershell.exe"
InitiatingProcessParentFileName endswith "powershell_ise.exe"
InitiatingProcessParentFileName endswith "pwsh.exe"

Standalone Content:

Hunting Query Selection Criteria
First-Time Network Connection by Unusual Process
Gentlemen Ransomware C2 domain connection RemoteUrl has_any "trycloudflare"
MDE_Networktrafficgoingtoport RemotePort in "443,80"
MDE_Networktrafficgoingtoport-DNS RemotePort == "53"
MDE_SmartScreenCheck ActionType in "ExploitGuardNetworkProtectionBlocked,SmartScreenUrlWarning"
InitiatingProcessAccountName contains "Matt"
InitiatingProcessFileName in "chrome.exe,msedge.exe"
RemoteUrl contains "facebook"
Potential rootkit network activity missing from MDE

GitHub Only:

Hunting Query Selection Criteria
Baseline Comparison
CVE-2022-22965 Network Activity ActionType == "NetworkSignatureInspected"
AdditionalFields contains ".jsp?cmd="
Connection to Rare DNS Hosts RemoteUrl contains "."
Connectivity Failures by Device ActionType == "ConnectionFailed"
Connectivity Failures by Domain ActionType == "ConnectionFailed"
DNSPattern [Nobelium]
Defender for Endpoint Telemetry
Detect Azure RemoteIP
DetectTorrentUse InitiatingProcessFileName contains "azureus"
InitiatingProcessFileName has "torrent"
InitiatingProcessFileName has "vuze"
RemoteUrl endswith ".tor"
RemoteUrl has "azureus"
RemoteUrl has "torrent"
RemoteUrl has "vuze"
Device network events w low count FQDN InitiatingProcessFileName !in "iexplore.exe,chrome.exe,opera.exe,safari.exe"
Discover hosts doing possible network scans RemoteIP startswith "172.16"
RemoteIP startswith "192.168"
Discovering potentially tampered devices [Nobelium]
DofoilNameCoinServerTraffic RemoteIP in "103.253.12.18,107.150.40.234,130.255.73.90,139.59.208.246,142.0.68.13,144.76.133.38,162.211.64.20,169.239.202.202,185.121.177.177,185.121.177.53,185.97.7.7,193.183.98.154,217.12.210.54,31.3.135.232,5.135.183.146,51.255.167.0,52.174.55.168,62.112.8.85,62.113.203.55,69.164.196.21,87.98.175.85,89.18.27.34,91.121.155.13"
Download of New File Using Curl InitiatingProcessFileName has "curl"
EncodedDomainURL [Nobelium]
Excel file download domain pattern
File Copy and Execution ActionType in "FileCreated,FileModified"
LocalPort == "445"
File footprint (1)
Firewall Policy Design Assistant ActionType in "ConnectionFound,ConnectionRequest,ConnectionSuccess,InboundConnectionAccepted,ListeningConnectionCreated"
RemoteIPType != "Loopback"
Flash-CVE-2018-4848 InitiatingProcessFileName == "cmd.exe"
InitiatingProcessParentFileName == "excel.exe"
RemoteUrl endswith ".kr"
KNOTWEED-Domain IOCs
KNOTWEED-Downloading new file using Curl InitiatingProcessFileName has "curl"
LemonDuck-control-structure InitiatingProcessFileName == "powershell.exe"
LemonDuck-id-generation InitiatingProcessCommandLine endswith "(@($env:COMPUTERNAME,$env:USERNAME,(get-wmiobject Win32_ComputerSystemProduct).UUID,(random))-join"
InitiatingProcessFileName == "powershell.exe"
Network footprint RemoteIP == "IP ADDRESS GOES HERE"
RemoteUrl endswith "DNS ENTRY GOES HERE"
Network footprint (1)
Payload Delivery InitiatingProcessCommandLine endswith "-OutFile tim.EXE"
InitiatingProcessFileName == "powershell.exe"
Qakbot Craigslist Domains
Qakbot Craigslist Domains
Rare-process-as-a-service
Remote Management and Monitoring tool - AeroAdmin - Network Connection InitiatingProcessVersionInfoCompanyName has_any "AeroAdmin"
InitiatingProcessVersionInfoProductName has_any "AeroAdmin"
RemoteUrl has "aeroadmin.com"
Remote Management and Monitoring tool - All Tools - Network Connection
Remote Management and Monitoring tool - Ammyy - Network Connection InitiatingProcessVersionInfoCompanyName has "ammyy"
InitiatingProcessVersionInfoProductName has "ammyy admin"
RemoteUrl has "ammyy.com"
Remote Management and Monitoring tool - AnyDesk - Network Connection InitiatingProcessVersionInfoProductName has "AnyDesk"
RemoteUrl has_any "anydesk.com"
Remote Management and Monitoring tool - AnyViewer - Network Connection InitiatingProcessVersionInfoCompanyName has "AOMEI"
InitiatingProcessVersionInfoProductName has "AnyViewer"
RemoteUrl has_any "anyviewer.com"
Remote Management and Monitoring tool - Atera - Network Connection InitiatingProcessVersionInfoCompanyName has "Atera Networks"
RemoteUrl has_any "atera.com"
Remote Management and Monitoring tool - AweSun - Network Connection InitiatingProcessVersionInfoCompanyName has "AweRay"
InitiatingProcessVersionInfoProductName has "AweSun"
RemoteUrl has_any "aweray.com"
Remote Management and Monitoring tool - BarracudaRMM - Network Connection InitiatingProcessVersionInfoCompanyName has_any "Barracuda MSP"
RemoteUrl has_any "rmm.barracudamsp.com"
Remote Management and Monitoring tool - BeyondTrust - Network Connection InitiatingProcessVersionInfoCompanyName has_any "BeyondTrust"
RemoteUrl has_any "license.bomgar.com"
Remote Management and Monitoring tool - ChromeRDP - Network Connection InitiatingProcessVersionInfoCompanyName has "Google"
InitiatingProcessVersionInfoProductName has "Chrome Remote Desktop"
RemoteUrl has "remotedesktop-pa.googleapis.com"
Remote Management and Monitoring tool - ConnectWise - Network Connection InitiatingProcessVersionInfoCompanyName has_any "ConnectWise"
RemoteUrl has_any "myconnectwise.com"
Remote Management and Monitoring tool - DameWare - Network Connection InitiatingProcessVersionInfoCompanyName has_any "DameWare"
InitiatingProcessVersionInfoFileDescription has "DameWare"
InitiatingProcessVersionInfoProductName has "DameWare"
RemoteUrl has_any "swi-rc.com"
Remote Management and Monitoring tool - DattoRMM - Network Connection InitiatingProcessVersionInfoCompanyName has_any "CentraStage"
RemoteUrl has_any "rmm.datto.com"
Remote Management and Monitoring tool - DesktopNow - Network Connection InitiatingProcessVersionInfoCompanyName has "NCH Software"
InitiatingProcessVersionInfoProductName has "DesktopNow"
RemoteUrl has "nchuser.com"
Remote Management and Monitoring tool - DistantDesktop - Network Connection InitiatingProcessVersionInfoCompanyName has "Distant Software"
InitiatingProcessVersionInfoProductName has "Distant Desktop"
RemoteUrl has_any "distantdesktop.com"
Remote Management and Monitoring tool - FleetDeck - Network Connection InitiatingProcessFileName startswith "fleetdeck"
InitiatingProcessVersionInfoCompanyName has "fleetdeck"
RemoteUrl has_any "fleetdeck.io"
Remote Management and Monitoring tool - GetScreen - Network Connection InitiatingProcessVersionInfoCompanyName has "getscreen.me"
InitiatingProcessVersionInfoProductName has "getscreen.me"
RemoteUrl has_any "getscreen.me"
Remote Management and Monitoring tool - ISLOnline - Network Connection InitiatingProcessVersionInfoCompanyName has_any "Xlab"
RemoteUrl has "islonline.net"
Remote Management and Monitoring tool - IperiusRemote - Network Connection InitiatingProcessVersionInfoCompanyName has "Enter Srl"
InitiatingProcessVersionInfoProductName has "Iperius Remote"
RemoteUrl has_any "iperius"
Remote Management and Monitoring tool - Kaseya - Network Connection InitiatingProcessVersionInfoCompanyName has "Kaseya"
InitiatingProcessVersionInfoProductName has "Kaseya"
RemoteUrl has_any "kaseya.com"
Remote Management and Monitoring tool - Level - Network Connection InitiatingProcessFileName has "level"
RemoteUrl has_any "agents.level.io"
Remote Management and Monitoring tool - LiteManager - Network Connection InitiatingProcessVersionInfoProductName has_any "ROMViewer"
RemoteUrl has_any "litemanager.ru"
Remote Management and Monitoring tool - LogMeIn - Network Connection InitiatingProcessVersionInfoCompanyName has_any "LogMeIn"
RemoteUrl has_any "update-cdn.logmein.com"
Remote Management and Monitoring tool - MSP360_CloudBerry - Network Connection InitiatingProcessVersionInfoCompanyName has_any "CloudBerry"
RemoteUrl has_any "rm.mspbackups.com"
Remote Management and Monitoring tool - MeshCentral - Network Connection InitiatingProcessVersionInfoCompanyName has "meshcentral"
RemoteUrl has "meshcentral.com"
Remote Management and Monitoring tool - NAble - Network Connection InitiatingProcessVersionInfoCompanyName has_any "Remote Monitoring"
RemoteUrl has_any "remote.management"
Remote Management and Monitoring tool - Naverisk - Network Connection InitiatingProcessVersionInfoCompanyName has_any "naverisk"
Remote Management and Monitoring tool - NetSupport - Network Connection InitiatingProcessVersionInfoCompanyName has "netsupport"
RemoteUrl has "netsupportsoftware.com"
Remote Management and Monitoring tool - NinjaRMM - Network Connection InitiatingProcessVersionInfoCompanyName has_any "NinjaRMM"
RemoteUrl has "ninjarmm.com"
Remote Management and Monitoring tool - OptiTune - Network Connection InitiatingProcessVersionInfoCompanyName has "Bravura Software LLC"
RemoteUrl has_any "optitune.us"
Remote Management and Monitoring tool - PDQ - Network Connection InitiatingProcessVersionInfoProductName has "PDQConnectAgent"
RemoteUrl has_any "app.pdq.com"
Remote Management and Monitoring tool - Panorama9 - Network Connection InitiatingProcessVersionInfoCompanyName has "panorama9"
RemoteUrl has "panorama9.com"
Remote Management and Monitoring tool - PcVisit - Network Connection InitiatingProcessVersionInfoCompanyName has "pcvisit software ag"
RemoteUrl has_any "pcvisit.de"
Remote Management and Monitoring tool - Pulseway - Network Connection InitiatingProcessVersionInfoCompanyName has "MMSoft Design"
InitiatingProcessVersionInfoProductName has "Pulseway"
RemoteUrl has "pulseway.com"
Remote Management and Monitoring tool - RPort - Network Connection InitiatingProcessVersionInfoCompanyName has "RealVNC"
InitiatingProcessVersionInfoProductName has "rport"
Remote Management and Monitoring tool - RealVNC - Network Connection InitiatingProcessVersionInfoCompanyName has "realvnc"
RemoteUrl has_any "update-check.realvnc.com"
Remote Management and Monitoring tool - RemoteDesktopPlus - Network Connection InitiatingProcessVersionInfoCompanyName has "www.donkz.nl"
InitiatingProcessVersionInfoOriginalFileName has "rdp.exe"
InitiatingProcessVersionInfoProductName has "Remote Desktop Plus"
Remote Management and Monitoring tool - RemotePC - Network Connection InitiatingProcessVersionInfoCompanyName has "idrive"
InitiatingProcessVersionInfoProductName has_any "remotepc"
RemoteUrl has "remotepc.com"
Remote Management and Monitoring tool - RemoteUtilities - Network Connection InitiatingProcessVersionInfoCompanyName has "Remote Utilities"
InitiatingProcessVersionInfoProductName has "Remote Utilities"
RemoteUrl has "remoteutilities.com"
Remote Management and Monitoring tool - RustDesk - Network Connection InitiatingProcessVersionInfoProductName has "rustdesk"
RemoteUrl has "rustdesk.com"
Remote Management and Monitoring tool - ScreenMeet - Network Connection InitiatingProcessVersionInfoCompanyName has "Projector Inc"
InitiatingProcessVersionInfoProductName has "ScreenMeet"
RemoteUrl has "screenmeet.com"
Remote Management and Monitoring tool - ServerEye - Network Connection InitiatingProcessVersionInfoCompanyName has "Krämer IT Solutions GmbH"
InitiatingProcessVersionInfoProductName has_any "ServerEye"
RemoteUrl has "server-eye.de"
Remote Management and Monitoring tool - ShowMyPC - Network Connection InitiatingProcessVersionInfoCompanyName has "ShowMyPC"
InitiatingProcessVersionInfoProductName has "ShowMyPC"
RemoteUrl has "showmypc.com"
Remote Management and Monitoring tool - SimpleHelp - Network Connection InitiatingProcessVersionInfoCompanyName has "SimpleHelp"
InitiatingProcessVersionInfoProductName has "SimpleHelp"
RemoteUrl has "rmshelp.me"
Remote Management and Monitoring tool - Splashtop - Network Connection InitiatingProcessVersionInfoCompanyName has "Splashtop"
RemoteUrl has_any "splashtop.com"
Remote Management and Monitoring tool - SupRemo - Network Connection InitiatingProcessVersionInfoCompanyName has "NanoSystems"
RemoteUrl has_any "supremocontrol.com"
Remote Management and Monitoring tool - SyncroMSP - Network Connection InitiatingProcessVersionInfoCompanyName has "Servably, Inc."
RemoteUrl has_any "syncromsp.com"
Remote Management and Monitoring tool - TacticalRMM - Network Connection InitiatingProcessVersionInfoCompanyName has_any "AmidaWare"
RemoteUrl has "tacticalrmm.io"
Remote Management and Monitoring tool - TeamViewer - Network Connection InitiatingProcessVersionInfoCompanyName has "TeamViewer"
RemoteUrl has_any "teamviewer.com"
Remote Management and Monitoring tool - TigerVNC - Network Connection InitiatingProcessVersionInfoCompanyName has "TigerVNC"
InitiatingProcessVersionInfoProductName has "TigerVNC"
Remote Management and Monitoring tool - TightVNC - Network Connection InitiatingProcessVersionInfoCompanyName has "GlavSoft"
InitiatingProcessVersionInfoProductName has "TightVNC"
Remote Management and Monitoring tool - UltraViewer - Network Connection InitiatingProcessVersionInfoCompanyName has "DucFabulous"
InitiatingProcessVersionInfoProductName has "UltraViewer"
RemoteUrl has "ultraviewer.net"
Remote Management and Monitoring tool - XMReality - Network Connection InitiatingProcessVersionInfoCompanyName has "XMReality"
InitiatingProcessVersionInfoProductName has "XMReality"
RemoteUrl has "xmreality.com"
Remote Management and Monitoring tool - ZohoAssist - Network Connection InitiatingProcessVersionInfoCompanyName has "Zoho"
InitiatingProcessVersionInfoProductName has "Zoho Assist"
RemoteUrl has_any "assist.zoho.com"
Remote Management and Monitoring tool - mRemoteNG - Network Connection InitiatingProcessVersionInfoCompanyName has "mRemoteNG"
RemoteUrl has "mremoteng.org"
Remote Management and Monitoring tool - parsec.app - Network Connection InitiatingProcessVersionInfoCompanyName has "parsec"
RemoteUrl has_any "kessel-ws.parsec.app"
Remote Management and Montioring tool - Action1 - Network Connection InitiatingProcessVersionInfoCompanyName has "Action1"
InitiatingProcessVersionInfoProductName has "Action1"
RemoteUrl has "server.action1.com"
Remote Management and Montioring tool - Addigy - Network Connection InitiatingProcessFileName has_any "go-agent"
RemoteUrl has_any "prod.addigy.com"
Roasting ActionType == "LDAP query"
RunDLL Suspicious Network Connection InitiatingProcessCommandLine has ",GlobalOut"
InitiatingProcessFileName == "rundll32.exe"
SMB shares discovery InitiatingProcessId !in "0,4"
RemotePort == "445"
SolarWinds -CVE-2021-35211 ActionType == "ConnectionSuccess"
Protocol == "Tcp"
RemotePort == "443"
Star Blizzard-Domain IOCs
Tor InitiatingProcessFileName in "meek-client.exe,tor.exe"
c2-bluekeep
check-for-shadowhammer-activity-download-domain RemoteIP == "141.105.71.116"
RemoteUrl == "asushotfix.com"
check-for-shadowhammer-activity-implant
cve-2019-0808-c2 RemoteIP == "63.141.233.82"
RemoteUrl in "fffun-video.biz,luckluck.blog"
detect-bluekeep-exploitation-attempts InitiatingProcessFileName == "spoolsv.exe"
RemotePort == "3389"
detect-cyzfc-activity (1) RemoteUrl == "pandorasong.com"
detect-impacket-dcomexec
detect-impacket-wmiexec
detect-impacket-wmiexec
detect-impacket-wmiexec
detect-mailsniper
detect-steganography-exfiltration
detect-suspicious-rdp-connections ActionType == "ConnectionSuccess"
Protocol == "Tcp"
RemotePort == "3389"
insider-threat-detection-queries (11) RemotePort == "22"
insider-threat-detection-queries (5)
insider-threat-detection-queries (6)
insider-threat-detection-queries (9)
oceanlotus-apt32-network RemoteUrl in "C2 Indicators for OceanLotus Activities 2019,Malicious URL Indicators for OceanLotus Activities 2019,cortanasyn.com,cortanazone.com,load.newappssystems.com,open.betaoffice.net,outlook.updateoffices.net,ristineho.com,syn.servebbs.com"
printnightmare-cve-2021-1675 usage detection (1) LocalPort == "445"
rare_sch_task_with_activity
recon-with-rundll InitiatingProcessCommandLine has "rundll32.exe"
InitiatingProcessFileName == "rundll32.exe"
regsvr32-rundll32-image-loads-abnormal-extension RemoteIPType == "Public"
regsvr32-rundll32-with-anomalous-parent-process RemoteIPType == "Public"
snip3-malicious-network-connectivity InitiatingProcessCommandLine == "\"
InitiatingProcessFileName in "InstallUtil.exe,RegAsm.exe,RegSvcs.exe"
InitiatingProcessParentFileName endswith "Powershell.exe"
snip3-revengerat-c2-exfiltration RemoteUrl in "asin8988.ddns.net,asin8989.ddns.net,asin8990.ddns.net,h0pe1759.ddns.net,kexa600200.ddns.net,kimjoy.ddns.net,kimjoy007.dyndns.org,mail.alamdarhardware.com,n0ahark2021.ddns.net"
successive-tk-domain-calls RemoteUrl endswith ".tk"

Workbooks (9)

In solution DORA Compliance:

Workbook Selection Criteria
DORACompliance

In solution HIPAA Compliance: ActionType == "ConnectionSuccess"

Workbook
HIPAACompliance

In solution Lumen Defender Threat Feed:

Workbook Selection Criteria
Lumen-Threat-Feed-Overview

In solution MaturityModelForEventLogManagementM2131:

Workbook Selection Criteria
MaturityModelForEventLogManagement_M2131

In solution Microsoft Defender XDR:

Workbook Selection Criteria
MicrosoftDefenderForEndPoint

GitHub Only:

Workbook Selection Criteria
ExchangeCompromiseHunting InitiatingProcessFileName has_any "umworkerprocess.exe"
InitiatingProcessSHA256 == "256"
MicrosoftDefenderForEndPoint
MicrosoftSentinelDeploymentandMigrationTracker
SolarWindsPostCompromiseHunting

Parsers Using This Table (1)

ASIM Parsers (1) — Selection Criteria: ActionType == "ConnectionFailed"

Parser Schema Product
ASimNetworkSessionMicrosoft365Defender NetworkSession M365 Defender for Endpoint

Selection Criteria Summary (98 criteria, 114 total references)

References by type: 0 connectors, 113 content items, 1 ASIM parsers, 0 other parsers.

Selection Criteria Connectors Content Items ASIM Parsers Other Parsers Total
RemoteIPType == "Public" - 6 - - 6
ActionType !has "ConnectionFailed" - 6 - - 6
InitiatingProcessFileName has "curl" - 3 - - 3
ActionType == "ConnectionFailed" - 2 1 - 3
ActionType == "ConnectionSuccess" - 2 - - 2
InitiatingProcessCommandLine has "rundll32.exe"
InitiatingProcessFileName == "rundll32.exe"		 - 2 - - 2
ActionType == "InboundConnectionAccepted" - 1 - - 1
InitiatingProcessCommandLine == "\"
InitiatingProcessFileName in "InstallUtil.exe,RegAsm.exe,RegSvcs.exe"
InitiatingProcessParentFileName endswith "powershell.exe"
InitiatingProcessParentFileName endswith "powershell_ise.exe"
InitiatingProcessParentFileName endswith "pwsh.exe"		 - 1 - - 1
RemoteUrl == "pandorasong.com" - 1 - - 1
RemoteIP in "103.253.12.18,107.150.40.234,130.255.73.90,139.59.208.246,142.0.68.13,144.76.133.38,162.211.64.20,169.239.202.202,185.121.177.177,185.121.177.53,185.97.7.7,193.183.98.154,217.12.210.54,31.3.135.232,5.135.183.146,51.255.167.0,52.174.55.168,62.112.8.85,62.113.203.55,69.164.196.21,87.98.175.85,89.18.27.34,91.121.155.13" - 1 - - 1
RemoteUrl in "C2 Indicators for OceanLotus Activities 2019,Malicious URL Indicators for OceanLotus Activities 2019,cortanasyn.com,cortanazone.com,load.newappssystems.com,open.betaoffice.net,outlook.updateoffices.net,ristineho.com,syn.servebbs.com" - 1 - - 1
InitiatingProcessCommandLine == "\"
InitiatingProcessFileName in "InstallUtil.exe,RegAsm.exe,RegSvcs.exe"
InitiatingProcessParentFileName endswith "Powershell.exe"		 - 1 - - 1
RemoteUrl in "asin8988.ddns.net,asin8989.ddns.net,asin8990.ddns.net,h0pe1759.ddns.net,kexa600200.ddns.net,kimjoy.ddns.net,kimjoy007.dyndns.org,mail.alamdarhardware.com,n0ahark2021.ddns.net" - 1 - - 1
RemoteIP == "141.105.71.116"
RemoteUrl == "asushotfix.com"		 - 1 - - 1
RemoteUrl contains "." - 1 - - 1
InitiatingProcessFileName !in "iexplore.exe,chrome.exe,opera.exe,safari.exe" - 1 - - 1
InitiatingProcessFileName in "meek-client.exe,tor.exe" - 1 - - 1
InitiatingProcessFileName contains "azureus"
InitiatingProcessFileName has "torrent"
InitiatingProcessFileName has "vuze"
RemoteUrl endswith ".tor"
RemoteUrl has "azureus"
RemoteUrl has "torrent"
RemoteUrl has "vuze"		 - 1 - - 1
RemoteIP startswith "172.16"
RemoteIP startswith "192.168"		 - 1 - - 1
RemotePort == "53" - 1 - - 1
RemotePort in "443,80" - 1 - - 1
ActionType in "ExploitGuardNetworkProtectionBlocked,SmartScreenUrlWarning"
InitiatingProcessAccountName contains "Matt"
InitiatingProcessFileName in "chrome.exe,msedge.exe"
RemoteUrl contains "facebook"		 - 1 - - 1
ActionType == "LDAP query" - 1 - - 1
InitiatingProcessId !in "0,4"
RemotePort == "445"		 - 1 - - 1
ActionType in "FileCreated,FileModified"
LocalPort == "445"		 - 1 - - 1
ActionType == "NetworkSignatureInspected"
AdditionalFields contains ".jsp?cmd="		 - 1 - - 1
InitiatingProcessFileName == "cmd.exe"
InitiatingProcessParentFileName == "excel.exe"
RemoteUrl endswith ".kr"		 - 1 - - 1
LocalPort == "445" - 1 - - 1
ActionType == "ConnectionSuccess"
Protocol == "Tcp"
RemotePort == "443"		 - 1 - - 1
ActionType in "ConnectionFound,ConnectionRequest,ConnectionSuccess,InboundConnectionAccepted,ListeningConnectionCreated"
RemoteIPType != "Loopback"		 - 1 - - 1
RemotePort == "22" - 1 - - 1
RemoteIP == "IP ADDRESS GOES HERE"
RemoteUrl endswith "DNS ENTRY GOES HERE"		 - 1 - - 1
InitiatingProcessFileName == "spoolsv.exe"
RemotePort == "3389"		 - 1 - - 1
ActionType == "ConnectionSuccess"
Protocol == "Tcp"
RemotePort == "3389"		 - 1 - - 1
RemoteIP == "63.141.233.82"
RemoteUrl in "fffun-video.biz,luckluck.blog"		 - 1 - - 1
InitiatingProcessVersionInfoCompanyName has "Action1"
InitiatingProcessVersionInfoProductName has "Action1"
RemoteUrl has "server.action1.com"		 - 1 - - 1
InitiatingProcessFileName has_any "go-agent"
RemoteUrl has_any "prod.addigy.com"		 - 1 - - 1
InitiatingProcessVersionInfoCompanyName has_any "AeroAdmin"
InitiatingProcessVersionInfoProductName has_any "AeroAdmin"
RemoteUrl has "aeroadmin.com"		 - 1 - - 1
InitiatingProcessVersionInfoCompanyName has "ammyy"
InitiatingProcessVersionInfoProductName has "ammyy admin"
RemoteUrl has "ammyy.com"		 - 1 - - 1
InitiatingProcessVersionInfoProductName has "AnyDesk"
RemoteUrl has_any "anydesk.com"		 - 1 - - 1
InitiatingProcessVersionInfoCompanyName has "AOMEI"
InitiatingProcessVersionInfoProductName has "AnyViewer"
RemoteUrl has_any "anyviewer.com"		 - 1 - - 1
InitiatingProcessVersionInfoCompanyName has "Atera Networks"
RemoteUrl has_any "atera.com"		 - 1 - - 1
InitiatingProcessVersionInfoCompanyName has "AweRay"
InitiatingProcessVersionInfoProductName has "AweSun"
RemoteUrl has_any "aweray.com"		 - 1 - - 1
InitiatingProcessVersionInfoCompanyName has_any "Barracuda MSP"
RemoteUrl has_any "rmm.barracudamsp.com"		 - 1 - - 1
InitiatingProcessVersionInfoCompanyName has_any "BeyondTrust"
RemoteUrl has_any "license.bomgar.com"		 - 1 - - 1
InitiatingProcessVersionInfoCompanyName has "Google"
InitiatingProcessVersionInfoProductName has "Chrome Remote Desktop"
RemoteUrl has "remotedesktop-pa.googleapis.com"		 - 1 - - 1
InitiatingProcessVersionInfoCompanyName has_any "ConnectWise"
RemoteUrl has_any "myconnectwise.com"		 - 1 - - 1
InitiatingProcessVersionInfoCompanyName has_any "DameWare"
InitiatingProcessVersionInfoFileDescription has "DameWare"
InitiatingProcessVersionInfoProductName has "DameWare"
RemoteUrl has_any "swi-rc.com"		 - 1 - - 1
InitiatingProcessVersionInfoCompanyName has_any "CentraStage"
RemoteUrl has_any "rmm.datto.com"		 - 1 - - 1
InitiatingProcessVersionInfoCompanyName has "NCH Software"
InitiatingProcessVersionInfoProductName has "DesktopNow"
RemoteUrl has "nchuser.com"		 - 1 - - 1
InitiatingProcessVersionInfoCompanyName has "Distant Software"
InitiatingProcessVersionInfoProductName has "Distant Desktop"
RemoteUrl has_any "distantdesktop.com"		 - 1 - - 1
InitiatingProcessFileName startswith "fleetdeck"
InitiatingProcessVersionInfoCompanyName has "fleetdeck"
RemoteUrl has_any "fleetdeck.io"		 - 1 - - 1
InitiatingProcessVersionInfoCompanyName has "getscreen.me"
InitiatingProcessVersionInfoProductName has "getscreen.me"
RemoteUrl has_any "getscreen.me"		 - 1 - - 1
InitiatingProcessVersionInfoCompanyName has "Enter Srl"
InitiatingProcessVersionInfoProductName has "Iperius Remote"
RemoteUrl has_any "iperius"		 - 1 - - 1
InitiatingProcessVersionInfoCompanyName has_any "Xlab"
RemoteUrl has "islonline.net"		 - 1 - - 1
InitiatingProcessVersionInfoCompanyName has "Kaseya"
InitiatingProcessVersionInfoProductName has "Kaseya"
RemoteUrl has_any "kaseya.com"		 - 1 - - 1
InitiatingProcessFileName has "level"
RemoteUrl has_any "agents.level.io"		 - 1 - - 1
InitiatingProcessVersionInfoProductName has_any "ROMViewer"
RemoteUrl has_any "litemanager.ru"		 - 1 - - 1
InitiatingProcessVersionInfoCompanyName has_any "LogMeIn"
RemoteUrl has_any "update-cdn.logmein.com"		 - 1 - - 1
InitiatingProcessVersionInfoCompanyName has "meshcentral"
RemoteUrl has "meshcentral.com"		 - 1 - - 1
InitiatingProcessVersionInfoCompanyName has "mRemoteNG"
RemoteUrl has "mremoteng.org"		 - 1 - - 1
InitiatingProcessVersionInfoCompanyName has_any "CloudBerry"
RemoteUrl has_any "rm.mspbackups.com"		 - 1 - - 1
InitiatingProcessVersionInfoCompanyName has_any "Remote Monitoring"
RemoteUrl has_any "remote.management"		 - 1 - - 1
InitiatingProcessVersionInfoCompanyName has_any "naverisk" - 1 - - 1
InitiatingProcessVersionInfoCompanyName has "netsupport"
RemoteUrl has "netsupportsoftware.com"		 - 1 - - 1
InitiatingProcessVersionInfoCompanyName has_any "NinjaRMM"
RemoteUrl has "ninjarmm.com"		 - 1 - - 1
InitiatingProcessVersionInfoCompanyName has "Bravura Software LLC"
RemoteUrl has_any "optitune.us"		 - 1 - - 1
InitiatingProcessVersionInfoCompanyName has "panorama9"
RemoteUrl has "panorama9.com"		 - 1 - - 1
InitiatingProcessVersionInfoCompanyName has "parsec"
RemoteUrl has_any "kessel-ws.parsec.app"		 - 1 - - 1
InitiatingProcessVersionInfoCompanyName has "pcvisit software ag"
RemoteUrl has_any "pcvisit.de"		 - 1 - - 1
InitiatingProcessVersionInfoProductName has "PDQConnectAgent"
RemoteUrl has_any "app.pdq.com"		 - 1 - - 1
InitiatingProcessVersionInfoCompanyName has "MMSoft Design"
InitiatingProcessVersionInfoProductName has "Pulseway"
RemoteUrl has "pulseway.com"		 - 1 - - 1
InitiatingProcessVersionInfoCompanyName has "realvnc"
RemoteUrl has_any "update-check.realvnc.com"		 - 1 - - 1
InitiatingProcessVersionInfoCompanyName has "www.donkz.nl"
InitiatingProcessVersionInfoOriginalFileName has "rdp.exe"
InitiatingProcessVersionInfoProductName has "Remote Desktop Plus"		 - 1 - - 1
InitiatingProcessVersionInfoCompanyName has "idrive"
InitiatingProcessVersionInfoProductName has_any "remotepc"
RemoteUrl has "remotepc.com"		 - 1 - - 1
InitiatingProcessVersionInfoCompanyName has "Remote Utilities"
InitiatingProcessVersionInfoProductName has "Remote Utilities"
RemoteUrl has "remoteutilities.com"		 - 1 - - 1
InitiatingProcessVersionInfoCompanyName has "RealVNC"
InitiatingProcessVersionInfoProductName has "rport"		 - 1 - - 1
InitiatingProcessVersionInfoProductName has "rustdesk"
RemoteUrl has "rustdesk.com"		 - 1 - - 1
InitiatingProcessVersionInfoCompanyName has "Projector Inc"
InitiatingProcessVersionInfoProductName has "ScreenMeet"
RemoteUrl has "screenmeet.com"		 - 1 - - 1
InitiatingProcessVersionInfoCompanyName has "Krämer IT Solutions GmbH"
InitiatingProcessVersionInfoProductName has_any "ServerEye"
RemoteUrl has "server-eye.de"		 - 1 - - 1
InitiatingProcessVersionInfoCompanyName has "ShowMyPC"
InitiatingProcessVersionInfoProductName has "ShowMyPC"
RemoteUrl has "showmypc.com"		 - 1 - - 1
InitiatingProcessVersionInfoCompanyName has "SimpleHelp"
InitiatingProcessVersionInfoProductName has "SimpleHelp"
RemoteUrl has "rmshelp.me"		 - 1 - - 1
InitiatingProcessVersionInfoCompanyName has "Splashtop"
RemoteUrl has_any "splashtop.com"		 - 1 - - 1
InitiatingProcessVersionInfoCompanyName has "NanoSystems"
RemoteUrl has_any "supremocontrol.com"		 - 1 - - 1
InitiatingProcessVersionInfoCompanyName has "Servably, Inc."
RemoteUrl has_any "syncromsp.com"		 - 1 - - 1
InitiatingProcessVersionInfoCompanyName has_any "AmidaWare"
RemoteUrl has "tacticalrmm.io"		 - 1 - - 1
InitiatingProcessVersionInfoCompanyName has "TeamViewer"
RemoteUrl has_any "teamviewer.com"		 - 1 - - 1
InitiatingProcessVersionInfoCompanyName has "TigerVNC"
InitiatingProcessVersionInfoProductName has "TigerVNC"		 - 1 - - 1
InitiatingProcessVersionInfoCompanyName has "GlavSoft"
InitiatingProcessVersionInfoProductName has "TightVNC"		 - 1 - - 1
InitiatingProcessVersionInfoCompanyName has "DucFabulous"
InitiatingProcessVersionInfoProductName has "UltraViewer"
RemoteUrl has "ultraviewer.net"		 - 1 - - 1
InitiatingProcessVersionInfoCompanyName has "XMReality"
InitiatingProcessVersionInfoProductName has "XMReality"
RemoteUrl has "xmreality.com"		 - 1 - - 1
InitiatingProcessVersionInfoCompanyName has "Zoho"
InitiatingProcessVersionInfoProductName has "Zoho Assist"
RemoteUrl has_any "assist.zoho.com"		 - 1 - - 1
InitiatingProcessCommandLine has ",GlobalOut"
InitiatingProcessFileName == "rundll32.exe"		 - 1 - - 1
RemoteUrl endswith ".tk" - 1 - - 1
InitiatingProcessFileName == "powershell.exe" - 1 - - 1
InitiatingProcessCommandLine endswith "(@($env:COMPUTERNAME,$env:USERNAME,(get-wmiobject Win32_ComputerSystemProduct).UUID,(random))-join"
InitiatingProcessFileName == "powershell.exe"		 - 1 - - 1
RemoteUrl has_any "trycloudflare" - 1 - - 1
InitiatingProcessCommandLine endswith "-OutFile tim.EXE"
InitiatingProcessFileName == "powershell.exe"		 - 1 - - 1
Total 0 113 1 0 114

ActionType

Value Connectors Content Items ASIM Parsers Other Parsers Total
!has ConnectionFailed - 6 - - 6
ConnectionSuccess - 5 - - 5
ConnectionFailed - 2 1 - 3
InboundConnectionAccepted - 2 - - 2
ExploitGuardNetworkProtectionBlocked - 1 - - 1
SmartScreenUrlWarning - 1 - - 1
LDAP query - 1 - - 1
FileCreated - 1 - - 1
FileModified - 1 - - 1
NetworkSignatureInspected - 1 - - 1
ConnectionFound - 1 - - 1
ConnectionRequest - 1 - - 1
ListeningConnectionCreated - 1 - - 1

AdditionalFields

Value Connectors Content Items ASIM Parsers Other Parsers Total
contains .jsp?cmd= - 1 - - 1

InitiatingProcessAccountName

Value Connectors Content Items ASIM Parsers Other Parsers Total
contains Matt - 1 - - 1

InitiatingProcessCommandLine

Value Connectors Content Items ASIM Parsers Other Parsers Total
\ - 2 - - 2
has rundll32.exe - 2 - - 2
has ,GlobalOut - 1 - - 1
endswith (@($env:COMPUTERNAME,$env:USERNAME,(get-wmiobject Win32_ComputerSystemProduct).UUID,(random))-join - 1 - - 1
endswith -OutFile tim.EXE - 1 - - 1

InitiatingProcessFileName

Value Connectors Content Items ASIM Parsers Other Parsers Total
has curl - 3 - - 3
rundll32.exe - 3 - - 3
powershell.exe - 3 - - 3
InstallUtil.exe - 2 - - 2
RegAsm.exe - 2 - - 2
RegSvcs.exe - 2 - - 2
!= iexplore.exe - 1 - - 1
!= chrome.exe - 1 - - 1
!= opera.exe - 1 - - 1
!= safari.exe - 1 - - 1
meek-client.exe - 1 - - 1
tor.exe - 1 - - 1
contains azureus - 1 - - 1
has torrent - 1 - - 1
has vuze - 1 - - 1
chrome.exe - 1 - - 1
msedge.exe - 1 - - 1
cmd.exe - 1 - - 1
spoolsv.exe - 1 - - 1
has_any go-agent - 1 - - 1
startswith fleetdeck - 1 - - 1
has level - 1 - - 1

InitiatingProcessId

Value Connectors Content Items ASIM Parsers Other Parsers Total
!= 0 - 1 - - 1
!= 4 - 1 - - 1

InitiatingProcessParentFileName

Value Connectors Content Items ASIM Parsers Other Parsers Total
endswith powershell.exe - 1 - - 1
endswith powershell_ise.exe - 1 - - 1
endswith pwsh.exe - 1 - - 1
endswith Powershell.exe - 1 - - 1
excel.exe - 1 - - 1

InitiatingProcessVersionInfoCompanyName

Value Connectors Content Items ASIM Parsers Other Parsers Total
has Action1 - 1 - - 1
has_any AeroAdmin - 1 - - 1
has ammyy - 1 - - 1
has AOMEI - 1 - - 1
has Atera Networks - 1 - - 1
has AweRay - 1 - - 1
has_any Barracuda MSP - 1 - - 1
has_any BeyondTrust - 1 - - 1
has Google - 1 - - 1
has_any ConnectWise - 1 - - 1
has_any DameWare - 1 - - 1
has_any CentraStage - 1 - - 1
has NCH Software - 1 - - 1
has Distant Software - 1 - - 1
has fleetdeck - 1 - - 1
has getscreen.me - 1 - - 1
has Enter Srl - 1 - - 1
has_any Xlab - 1 - - 1
has Kaseya - 1 - - 1
has_any LogMeIn - 1 - - 1
has meshcentral - 1 - - 1
has mRemoteNG - 1 - - 1
has_any CloudBerry - 1 - - 1
has_any Remote Monitoring - 1 - - 1
has_any naverisk - 1 - - 1
has netsupport - 1 - - 1
has_any NinjaRMM - 1 - - 1
has Bravura Software LLC - 1 - - 1
has panorama9 - 1 - - 1
has parsec - 1 - - 1
has pcvisit software ag - 1 - - 1
has MMSoft Design - 1 - - 1
has realvnc - 1 - - 1
has www.donkz.nl - 1 - - 1
has idrive - 1 - - 1
has Remote Utilities - 1 - - 1
has RealVNC - 1 - - 1
has Projector Inc - 1 - - 1
has Krämer IT Solutions GmbH - 1 - - 1
has ShowMyPC - 1 - - 1
has SimpleHelp - 1 - - 1
has Splashtop - 1 - - 1
has NanoSystems - 1 - - 1
has Servably, Inc. - 1 - - 1
has_any AmidaWare - 1 - - 1
has TeamViewer - 1 - - 1
has TigerVNC - 1 - - 1
has GlavSoft - 1 - - 1
has DucFabulous - 1 - - 1
has XMReality - 1 - - 1
has Zoho - 1 - - 1

InitiatingProcessVersionInfoFileDescription

Value Connectors Content Items ASIM Parsers Other Parsers Total
has DameWare - 1 - - 1

InitiatingProcessVersionInfoOriginalFileName

Value Connectors Content Items ASIM Parsers Other Parsers Total
has rdp.exe - 1 - - 1

InitiatingProcessVersionInfoProductName

Value Connectors Content Items ASIM Parsers Other Parsers Total
has Action1 - 1 - - 1
has_any AeroAdmin - 1 - - 1
has ammyy admin - 1 - - 1
has AnyDesk - 1 - - 1
has AnyViewer - 1 - - 1
has AweSun - 1 - - 1
has Chrome Remote Desktop - 1 - - 1
has DameWare - 1 - - 1
has DesktopNow - 1 - - 1
has Distant Desktop - 1 - - 1
has getscreen.me - 1 - - 1
has Iperius Remote - 1 - - 1
has Kaseya - 1 - - 1
has_any ROMViewer - 1 - - 1
has PDQConnectAgent - 1 - - 1
has Pulseway - 1 - - 1
has Remote Desktop Plus - 1 - - 1
has_any remotepc - 1 - - 1
has Remote Utilities - 1 - - 1
has rport - 1 - - 1
has rustdesk - 1 - - 1
has ScreenMeet - 1 - - 1
has_any ServerEye - 1 - - 1
has ShowMyPC - 1 - - 1
has SimpleHelp - 1 - - 1
has TigerVNC - 1 - - 1
has TightVNC - 1 - - 1
has UltraViewer - 1 - - 1
has XMReality - 1 - - 1
has Zoho Assist - 1 - - 1

LocalPort

Value Connectors Content Items ASIM Parsers Other Parsers Total
445 - 2 - - 2

Protocol

Value Connectors Content Items ASIM Parsers Other Parsers Total
Tcp - 2 - - 2

RemoteIP

Value Connectors Content Items ASIM Parsers Other Parsers Total
103.253.12.18 - 1 - - 1
107.150.40.234 - 1 - - 1
130.255.73.90 - 1 - - 1
139.59.208.246 - 1 - - 1
142.0.68.13 - 1 - - 1
144.76.133.38 - 1 - - 1
162.211.64.20 - 1 - - 1
169.239.202.202 - 1 - - 1
185.121.177.177 - 1 - - 1
185.121.177.53 - 1 - - 1
185.97.7.7 - 1 - - 1
193.183.98.154 - 1 - - 1
217.12.210.54 - 1 - - 1
31.3.135.232 - 1 - - 1
5.135.183.146 - 1 - - 1
51.255.167.0 - 1 - - 1
52.174.55.168 - 1 - - 1
62.112.8.85 - 1 - - 1
62.113.203.55 - 1 - - 1
69.164.196.21 - 1 - - 1
87.98.175.85 - 1 - - 1
89.18.27.34 - 1 - - 1
91.121.155.13 - 1 - - 1
141.105.71.116 - 1 - - 1
startswith 172.16 - 1 - - 1
startswith 192.168 - 1 - - 1
IP ADDRESS GOES HERE - 1 - - 1
63.141.233.82 - 1 - - 1

RemoteIPType

Value Connectors Content Items ASIM Parsers Other Parsers Total
Public - 6 - - 6
!= Loopback - 1 - - 1

RemotePort

Value Connectors Content Items ASIM Parsers Other Parsers Total
443 - 2 - - 2
3389 - 2 - - 2
53 - 1 - - 1
80 - 1 - - 1
445 - 1 - - 1
22 - 1 - - 1

RemoteUrl

Value Connectors Content Items ASIM Parsers Other Parsers Total
pandorasong.com - 1 - - 1
C2 Indicators for OceanLotus Activities 2019 - 1 - - 1
Malicious URL Indicators for OceanLotus Activities 2019 - 1 - - 1
cortanasyn.com - 1 - - 1
cortanazone.com - 1 - - 1
load.newappssystems.com - 1 - - 1
open.betaoffice.net - 1 - - 1
outlook.updateoffices.net - 1 - - 1
ristineho.com - 1 - - 1
syn.servebbs.com - 1 - - 1
asin8988.ddns.net - 1 - - 1
asin8989.ddns.net - 1 - - 1
asin8990.ddns.net - 1 - - 1
h0pe1759.ddns.net - 1 - - 1
kexa600200.ddns.net - 1 - - 1
kimjoy.ddns.net - 1 - - 1
kimjoy007.dyndns.org - 1 - - 1
mail.alamdarhardware.com - 1 - - 1
n0ahark2021.ddns.net - 1 - - 1
asushotfix.com - 1 - - 1
contains . - 1 - - 1
endswith .tor - 1 - - 1
has azureus - 1 - - 1
has torrent - 1 - - 1
has vuze - 1 - - 1
contains facebook - 1 - - 1
endswith .kr - 1 - - 1
endswith DNS ENTRY GOES HERE - 1 - - 1
fffun-video.biz - 1 - - 1
luckluck.blog - 1 - - 1
has server.action1.com - 1 - - 1
has_any prod.addigy.com - 1 - - 1
has aeroadmin.com - 1 - - 1
has ammyy.com - 1 - - 1
has_any anydesk.com - 1 - - 1
has_any anyviewer.com - 1 - - 1
has_any atera.com - 1 - - 1
has_any aweray.com - 1 - - 1
has_any rmm.barracudamsp.com - 1 - - 1
has_any license.bomgar.com - 1 - - 1
has remotedesktop-pa.googleapis.com - 1 - - 1
has_any myconnectwise.com - 1 - - 1
has_any swi-rc.com - 1 - - 1
has_any rmm.datto.com - 1 - - 1
has nchuser.com - 1 - - 1
has_any distantdesktop.com - 1 - - 1
has_any fleetdeck.io - 1 - - 1
has_any getscreen.me - 1 - - 1
has_any iperius - 1 - - 1
has islonline.net - 1 - - 1
has_any kaseya.com - 1 - - 1
has_any agents.level.io - 1 - - 1
has_any litemanager.ru - 1 - - 1
has_any update-cdn.logmein.com - 1 - - 1
has meshcentral.com - 1 - - 1
has mremoteng.org - 1 - - 1
has_any rm.mspbackups.com - 1 - - 1
has_any remote.management - 1 - - 1
has netsupportsoftware.com - 1 - - 1
has ninjarmm.com - 1 - - 1
has_any optitune.us - 1 - - 1
has panorama9.com - 1 - - 1
has_any kessel-ws.parsec.app - 1 - - 1
has_any pcvisit.de - 1 - - 1
has_any app.pdq.com - 1 - - 1
has pulseway.com - 1 - - 1
has_any update-check.realvnc.com - 1 - - 1
has remotepc.com - 1 - - 1
has remoteutilities.com - 1 - - 1
has rustdesk.com - 1 - - 1
has screenmeet.com - 1 - - 1
has server-eye.de - 1 - - 1
has showmypc.com - 1 - - 1
has rmshelp.me - 1 - - 1
has_any splashtop.com - 1 - - 1
has_any supremocontrol.com - 1 - - 1
has_any syncromsp.com - 1 - - 1
has tacticalrmm.io - 1 - - 1
has_any teamviewer.com - 1 - - 1
has ultraviewer.net - 1 - - 1
has xmreality.com - 1 - - 1
has_any assist.zoho.com - 1 - - 1
endswith .tk - 1 - - 1
has_any trycloudflare - 1 - - 1

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Tables Index