DeviceNetworkEvents

← All KQL categories

Data Source

DeviceNetworkEvents

7 queries tagged with this data source.

• Analytics Rules Detect Ci Build Egress To First Seen Domain

  CI/CD build process reaching out to a domain never seen from your build fleet before — 'the build that called a stranger.'

• Analytics Rules Detect Excel Xll Addin Spawning Shell Or Network

  Excel loading an XLL add-in that then spawns a shell or beacons out — the spreadsheet-as-shell malware delivery vector.

• Hunting Hunt Blockchain Rpc C2 Dead Drop

  C2 traffic hidden inside blockchain-RPC calls to public utilities (QuickNode, Alchemy) — 'the dead drop is a public utility.'

• Hunting Hunt C2 Beacon By Connection Window Rhythm

  Low-and-slow C2 beacon hunt that counts distinct hourly time windows a process was connected in — not raw connection volume.

• Hunting Hunt Cloud Storage Bucket Lookalike References

  References to cloud storage buckets whose names are lookalikes of your real ones — homoglyphs, dashes-for-underscores, plausibly-typosquatted variants.

• Hunting Hunt DNS Aaaa Record Covert Recovery Channel

  Project CAV3RN's DNS AAAA-record recovery channel — IPv6 addresses returned in AAAA queries that decode as ASCII or structured config.

• Hunting Hunt Npm Postinstall Grandchild Network Payload

  npm supply-chain worms where the payload runs two process generations down — 'sins of the grandfather' shape. Traces npm → sh -c → curl.