Lesson 8 — Investigating DeviceNetworkEvents
Network events show where endpoint processes communicated, when the connection occurred and which process created it.
Microsoft Defender for Endpoint exposes this activity through DeviceNetworkEvents, allowing analysts to investigate command-and-control, malicious downloads, lateral movement and data exfiltration.
This lesson explains how to connect network destinations with process, command-line, user and timeline evidence to determine why the communication matters.
What you will learn
This lesson explains how to investigate endpoint network activity using DeviceNetworkEvents.
Learning objectives
After completing this lesson, you should be able to investigate endpoint network activity using Defender for Endpoint telemetry.
- Explain what DeviceNetworkEvents records.
- Interpret remote IP addresses, URLs, ports and protocols.
- Identify the process and user responsible for a connection.
- Recognise suspicious command-and-control and lateral movement patterns.
- Correlate network activity with process, file and timeline evidence.
The problem this solves
A network destination by itself rarely explains intent.
DeviceNetworkEvents connects the destination to the process, command line, user and device that created the communication.
What is DeviceNetworkEvents?
DeviceNetworkEvents is the Advanced Hunting table used to investigate network connections observed on endpoints.
It helps analysts answer who connected, where they connected, when it happened and which process caused the activity.
Do not investigate the destination alone. Start with the initiating process and reconstruct why the connection occurred.
How network activity becomes evidence
Why network telemetry matters
Many attacks communicate externally or laterally after execution.
Network telemetry can reveal command-and-control, payload delivery, exfiltration, remote access and movement between devices.
Timestamp
The timestamp shows when the connection occurred.
Correlate it with the initiating process, file creation and alert time to understand where the connection fits in the attack sequence.
DeviceName
DeviceName identifies the endpoint that generated the network event.
Check whether the device is high value, exposed, risky or involved in other alerts.
RemoteIP
RemoteIP identifies the destination address contacted by the endpoint.
Determine whether it is public, private, loopback, link-local or part of known organisational infrastructure.
RemoteUrl
RemoteUrl may provide a domain or hostname associated with the connection.
Domains often give more context than an IP address, especially when cloud services, CDNs or shared hosting are involved.
RemotePort
RemotePort identifies the destination service port.
Ports such as 80, 443, 445, 3389, 22, 25 and 53 can suggest web, file sharing, remote desktop, SSH, mail or DNS activity.
LocalIP and LocalPort
Local address and port information show which endpoint interface and local socket were used.
This can help distinguish normal client connections from listening services or lateral movement activity.
Protocol
Protocol commonly identifies TCP or UDP communication.
Use the protocol together with port and process context to understand the expected behaviour.
Common ports and investigation context
| Port | Typical use | Investigation context |
|---|---|---|
| 80 / 443 | HTTP and HTTPS | Web access, downloads, cloud services or command-and-control. |
| 445 | SMB | File sharing, administration or lateral movement. |
| 3389 | RDP | Remote administration or interactive lateral movement. |
| 22 | SSH | Remote access, automation or unauthorised administration. |
| 53 | DNS | Name resolution, tunnelling or unusual lookup behaviour. |
InitiatingProcessFileName
This field identifies the process responsible for the connection.
It is often the most important field because it connects network activity back to endpoint execution.
InitiatingProcessCommandLine
The initiating command line can explain why the process connected.
URLs, encoded commands, download switches and script parameters may expose attacker intent.
Initiating process account
Account fields identify the user or security context responsible for the initiating process.
Determine whether the connection was created by a standard user, administrator, service account or SYSTEM.
Parent process context
The parent process may reveal how the network-capable process started.
For example, winword.exe launching powershell.exe followed by HTTPS communication is more suspicious than a browser opening the same destination.
Example attack sequence
Public IP addresses
Public IP addresses route across the internet.
Check reputation, ASN, hosting provider, geography and whether the destination is expected for the initiating application.
Private IP addresses
Private addresses usually represent internal systems.
Unexpected connections to internal devices may indicate discovery, lateral movement or unauthorised administration.
Domains and cloud services
Attackers may use legitimate cloud storage, CDNs and collaboration platforms.
Domain reputation alone is not enough; inspect the initiating process, path and timing.
Threat intelligence
Threat intelligence can provide reputation, malware associations, hosting information and previous observations.
Use intelligence as supporting evidence rather than the sole basis for a decision.
Command-and-control
Command-and-control traffic allows attackers to issue instructions or receive stolen data.
Look for repeated outbound connections, unusual intervals, rare destinations and suspicious initiating processes.
Beaconing
Beaconing is repeated communication at regular or semi-regular intervals.
Compare timestamps and destination patterns to identify periodic connections that may indicate malware callbacks.
Malicious downloads
Network events may reveal a process retrieving scripts, executables or archives.
Pivot to DeviceFileEvents to confirm what was created and DeviceProcessEvents to determine whether it executed.
Data exfiltration
Exfiltration may involve cloud storage, web uploads, FTP, custom protocols or encrypted channels.
Look for unusual destinations, archive creation and suspicious user context.
Lateral movement
Lateral movement occurs when an attacker connects from one endpoint to another.
SMB, RDP, WinRM and SSH activity can all be legitimate or malicious depending on the user, process and target.
DNS activity
DNS activity can reveal domain lookups, algorithmic domains and tunnelling.
Correlate DNS queries with subsequent connections and initiating process behaviour.
Inbound connections
Inbound activity may indicate exposed services, remote administration or exploitation.
Review the listening process, source address, port and whether the connection was expected.
Pivot to DeviceProcessEvents
Use the initiating process fields to investigate the executable that created the connection.
Review command line, parent process, user, hash and child processes.
Pivot to DeviceFileEvents
Check whether the connection resulted in file creation, modification or deletion.
This can confirm downloads, payload staging or exfiltration preparation.
Pivot to the Device Timeline
The timeline shows the connection alongside process, file, registry and logon activity.
Use it to reconstruct what happened immediately before and after communication.
Pivot to the Defender XDR incident
The wider incident may contain identity, email or cloud evidence connected to the same destination.
Do not limit the investigation to the endpoint if cross-domain evidence exists.
Network investigation workflow
Common mistake
A common mistake is blocking an IP address without understanding the process or destination context.
Shared hosting, CDNs and cloud services can make a destination appear suspicious or benign for the wrong reasons.
Another common mistake
Do not ignore timestamps, user context or the initiating command line.
These fields often explain why the connection occurred and whether it was authorised.
Agent Foskett investigation tip
Correlate both sides of the activity before deciding whether the communication represents normal business traffic, command-and-control, lateral movement or exfiltration.
Best practices
- Start with the initiating process.
- Read the full command line.
- Review IP, domain, port and protocol together.
- Use threat intelligence as supporting context.
- Correlate file and process activity.
- Check for repeated or organisation-wide connections.
Agent Foskett takeaway
Process telemetry explains execution. Network telemetry explains communication.
Understanding both allows analysts to identify command-and-control, malicious downloads, lateral movement and data exfiltration with much greater confidence.
Related Agent Foskett learning
Continue learning
Microsoft Defender for Endpoint DeviceNetworkEvents
DeviceNetworkEvents records endpoint network connections, including remote IP addresses, domains, URLs, ports, protocols, initiating processes, command lines and user context.
Module 2 Endpoint Telemetry — DeviceNetworkEvents Lesson 8
This Agent Foskett Defender for Endpoint Academy lesson explains how analysts investigate command-and-control, malicious downloads, lateral movement, DNS activity and data exfiltration using network telemetry.
