SOC Event Lookup
Event ID 3NetworkP1

Sysmon Event ID 3: Network connection detected

Applicable version
Sysmon 1.0 and later; network connection logging must be enabled
Last reviewed
2026-07-21

Quick summary

Sysmon Event ID 3 records network connections initiated by a process and links outbound activity to the responsible image, user, process GUID, and destination.

Technical Metadata

Technical metadata for Event ID 3
Event ID3
ProviderMicrosoft-Windows-Sysmon
ChannelMicrosoft-Windows-Sysmon/Operational
LevelInformational
MITRE ATT&CKTA0011 Command and Control / T1071.001 Application Layer Protocol: Web Protocols
Key fields to watchImage / ProcessGuid, DestinationIp / DestinationHostname, DestinationPort, Initiated

Trigger Scenarios

Sysmon generates the event when a configured process establishes a TCP or UDP connection. The event is disabled by default in Sysmon and must be explicitly enabled in the configuration.

Key Fields

Image / ProcessGuid

The executable and stable process identifier responsible for the connection. ProcessGuid can be joined to Event ID 1 for command-line and parent-process context.

DestinationIp / DestinationHostname

The remote address and hostname observed for the connection. Compare both values because name resolution and direct-IP connections provide different investigative clues.

DestinationPort

The remote service port. Rare ports, ports that do not match the process role, and external administrative services are useful starting points.

Initiated

Indicates whether the local process initiated the connection. Most outbound command-and-control hunting focuses on initiated connections.

Threat Hunting Queries

Microsoft Sentinel KQL: Retrieve Sysmon Event ID 3
Event
| where EventLog == "Microsoft-Windows-Sysmon/Operational" and EventID == 3
| project TimeGenerated, Computer, RenderedDescription
| order by TimeGenerated desc
Data source
Microsoft Sentinel Event table
Assumptions
The Sysmon Operational channel is collected into Event and retains RenderedDescription. Apply the event-specific field and correlation guidance on this page after retrieving the base events.
Query reference
Splunk SPL: Retrieve Sysmon Event ID 3
index=sysmon source="WinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=3
| table _time, host, user, EventCode, Message
Data source
Splunk Sysmon event data
Assumptions
Index, source, and field aliases vary by Splunk deployment and Windows add-on version. Map provider fields from the raw event before adding event-specific filtering or aggregation.
Cortex XQL: Retrieve Sysmon Event ID 3
dataset = microsoft_windows_raw
| filter edr_event_id = 3
Data source
Cortex XDR microsoft_windows_raw
Assumptions
The Sysmon Operational channel is ingested into Cortex XDR. Event ID 3 is not globally unique; confirm Provider is Microsoft-Windows-Sysmon before applying Sysmon field semantics.
Query reference
Sigma rule: Sysmon Event ID 3
title: Sysmon Event ID 3
status: experimental
logsource:
    product: windows
    service: sysmon
detection:
    selection:
        EventID: 3
    condition: selection
falsepositives:
    - Legitimate administrative or system activity
level: informational
Data source
Sigma Windows Sysmon log source
Assumptions
This rule retrieves the event and is not a standalone malicious-behavior detection. Add the field conditions and correlations documented on this page in the destination SIEM.
Query reference

Documented Values and Codes

Documented event values and their security relevance
FieldValueMeaningSecurity relevance
InitiatedtrueThe recorded process initiated the network connection.This direction helps separate an outbound client connection from an accepted connection, but it does not establish malicious intent. Source
DestinationPort443The destination uses the conventional HTTPS port.Port 443 is common and not proof of web C2; combine it with Image, ProcessGuid, destination reputation, TLS or proxy telemetry, and timing. Source

MITRE ATT&CK Mapping

  • T1071.001Application Layer Protocol: Web Protocols

Detection Notes

T1071.001 Web Protocols triage becomes actionable when Initiated is true, DestinationPort is 443 or 80, and Image is a script host or an unsigned binary under C:\\Users\\. Neither the port nor process name is sufficient alone; join ProcessGuid to Event ID 1 and baseline repeated connections to the same DestinationIp before classifying beacon-like behavior.

Common False Positives

  • Browsers, endpoint agents, update clients, and cloud applications make frequent external connections.
  • CDNs and shared hosting can make an unfamiliar destination appear suspicious without additional context.
  • Remote administration and monitoring platforms can legitimately use uncommon ports.

Related Events

Sample Log

Sanitized event sample
UtcTime: 2026-07-10 03:20:14.000
ProcessGuid: {11111111-2222-3333-4444-555555555555}
Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
User: CORP\jsmith
Protocol: tcp
Initiated: true
DestinationHostname: example.invalid
DestinationIp: 203.0.113.10
DestinationPort: 443

Frequently Asked Questions

What does Sysmon Event ID 3 record?

Sysmon Event ID 3 records TCP or UDP network connections with process, user, source, destination, protocol, and connection-direction context when NetworkConnect logging is enabled.

Is Sysmon network connection logging enabled by default?

No. Microsoft states that Event ID 3 logging is disabled by default because of event volume and must be enabled through Sysmon configuration.

Does a connection to port 443 indicate command and control?

No. HTTPS is normal enterprise traffic; detection requires process identity, command line, destination, certificate or proxy context, frequency, and related DNS or process events.

Sources

Machine-readable JSON