Sysmon Event 3 network connection anomaly

Sysmon config: <NetworkConnect onmatch='exclude'><DestinationPort condition='is'>53</DestinationPort></NetworkConnect> + hunting de conexiones outbound sospechosas

Use Sysmon Event 3 (network connection) to detect anomalous outbound connections following credential dumping: C2 and exfiltration.

Enable Event 3 on your endpoints when you want the host's network layer: after a successful credential dump, the attacker almost always opens an outbound connection — to their C2 to receive the hashes, or to an exfiltration service. The config with onmatch='exclude' and the list of legitimate ports (53, 80, 443, 123...) reduces noise, and what remains are the rare connections: unusual ports, new external IPs, unsigned processes connecting. Temporal correlation (outbound connection minutes after an Event 10 on LSASS) is one of the most reliable hunting patterns: dumping and exfil are chained.

Don't use it without a well-calibrated exclusion config: Event 3 without filters is one of Sysmon's noisiest (every connection from every process). And watch out for the usual limitation: HTTPS traffic to legitimate domains (C2 over 443 with a similar domain) is not distinguishable by port — for that you need the network layer (Zeek, proxy) and beaconing analysis. Event 3 gives the origin (process + IP), not the content. In high-traffic environments, prioritize alerts by process: an unsigned binary from Temp connecting out is more signal than any port.