Network

Last updated 10 Nov 2026

On this page

Network answers: what does the host listen on and talk to - and is its traffic redirected or its files exposed?

At a glance

Question	What does the host listen on and talk to?
Reads	The TCP/IP tables now, logged connections (Security 5156, Sysmon 3, the firewall's log), the hosts file, proxies, shares and adapters.
Works best with	Filtering Platform Connection auditing, Sysmon network events, or the firewall's log of allowed connections.
Rule prefix	`NET`

Source	Evidence
TCP and UDP tables, with each connection's process and creation time	`network_endpoint`: connections and listeners now.
Security 5156; Sysmon 3	`network_connection`: connections logged in the past.
Windows Firewall's log files	`firewall_connection`
Hosts file, proxies (machine, WinHTTP, every user), shares	`network_setting`
Network adapters (addresses, gateways, DNS servers, DHCP)	`network_adapter`

12 rules: 3 high, 9 medium. The full text of each is in the rule catalog.

ID	Severity	Title	Evidence	ATT&CK
`NET-HOSTS-FOLDER-MOVED`	high	Windows reads its hosts file from another folder	`network_setting`	`T1685`, `T1557`
`NET-HOSTS-SECURITY-DOMAIN`	high	The hosts file redirects a security or update service	`network_setting`	`T1685`
`NET-SYSTEM-BINARY-PUBLIC`	high	A Windows binary abused to fetch or run code connected to the Internet	`network_endpoint`, `network_connection`	`T1218`, `T1105`
`NET-LISTENER-UNSIGNED`	medium	An unsigned program is listening for connections	`network_endpoint`	-
`NET-LISTENER-USER-FOLDER`	medium	A program from a user or temporary folder is listening for connections	`network_endpoint`	-
`NET-POWERSHELL-PUBLIC`	medium	PowerShell connected to the Internet	`network_endpoint`, `network_connection`	`T1059.001`, `T1105`
`NET-PROXY-LOOPBACK`	medium	Web traffic is sent through a program on this host	`network_setting`	`T1557`, `T1090`
`NET-PROXY-PUBLIC-ADDRESS`	medium	Web traffic is sent through a proxy at a bare Internet address	`network_setting`	`T1090`, `T1557`
`NET-REMOTE-ACCESS-PORT`	medium	A program outside Windows is listening on a remote-access port	`network_endpoint`	`T1219`, `T1133`
`NET-SHARE-WHOLE-DRIVE`	medium	A whole drive is shared	`network_setting`	`T1021.002`
`NET-SMB-TO-INTERNET`	medium	The host connected to file sharing (SMB) on the Internet	`network_endpoint`, `network_connection`, `firewall_connection`	`T1187`, `T1048`
`NET-USER-FOLDER-PUBLIC`	medium	A program from a user or temporary folder connected to the Internet	`network_endpoint`, `network_connection`	`T1071`

Listeners: what is open, and which program opened it. An unexpected listener is a door.
Remote addresses and internal addresses: the public and private addresses the host talked to, with counts and first and last seen - for stacking across hosts and for the console's Topology page.
Settings: a hosts entry that redirects a security vendor, or a proxy nobody set, changes where traffic goes.

RemoteAccess: tools that can reach and control the host.