Data Source: Sysmon for Linux EventID 3

Date: 2026-08-07

ID: c56ce9d3-a37e-43a5-a0e6-b3b7d03600a4

Author: Nasreddine Bencherchali, Splunk

Description

Logs network connection creation events on Linux systems, including details about the source and destination IPs, ports, protocols, and the associated process metadata.

Details

Property	Value
Source	`Syslog:Linux-Sysmon/Operational`
Sourcetype	`sysmon:linux`
Separator	EventID

Name ▲▼	Technique ▲▼	Type ▲▼
Linux Netcat Outbound Connection	Unix Shell	Anomaly

Supported Apps

Splunk Add-on for Sysmon for Linux (version 1.0.0)

Event Fields

+ Fields

  <span class="pill kill-chain">_time</span>
  
  <span class="pill kill-chain">action</span>
  
  <span class="pill kill-chain">app</span>
  
  <span class="pill kill-chain">Computer</span>
  
  <span class="pill kill-chain">creation_time</span>
  
  <span class="pill kill-chain">date_hour</span>
  
  <span class="pill kill-chain">date_mday</span>
  
  <span class="pill kill-chain">date_minute</span>
  
  <span class="pill kill-chain">date_month</span>
  
  <span class="pill kill-chain">date_second</span>
  
  <span class="pill kill-chain">date_wday</span>
  
  <span class="pill kill-chain">date_year</span>
  
  <span class="pill kill-chain">date_zone</span>
  
  <span class="pill kill-chain">dest</span>
  
  <span class="pill kill-chain">dest_ip</span>
  
  <span class="pill kill-chain">dest_port</span>
  
  <span class="pill kill-chain">DestinationHostname</span>
  
  <span class="pill kill-chain">DestinationIp</span>
  
  <span class="pill kill-chain">DestinationIsIpv6</span>
  
  <span class="pill kill-chain">DestinationPort</span>
  
  <span class="pill kill-chain">DestinationPortName</span>
  
  <span class="pill kill-chain">direction</span>
  
  <span class="pill kill-chain">dvc</span>
  
  <span class="pill kill-chain">dvc_ip</span>
  
  <span class="pill kill-chain">EventDescription</span>
  
  <span class="pill kill-chain">EventID</span>
  
  <span class="pill kill-chain">eventtype</span>
  
  <span class="pill kill-chain">Guid</span>
  
  <span class="pill kill-chain">host</span>
  
  <span class="pill kill-chain">Image</span>
  
  <span class="pill kill-chain">index</span>
  
  <span class="pill kill-chain">Initiated</span>
  
  <span class="pill kill-chain">Interesting Fields</span>
  
  <span class="pill kill-chain">Keywords</span>
  
  <span class="pill kill-chain">linecount</span>
  
  <span class="pill kill-chain">Name</span>
  
  <span class="pill kill-chain">process_exec</span>
  
  <span class="pill kill-chain">process_guid</span>
  
  <span class="pill kill-chain">process_id</span>
  
  <span class="pill kill-chain">process_name</span>
  
  <span class="pill kill-chain">ProcessGuid</span>
  
  <span class="pill kill-chain">ProcessId</span>
  
  <span class="pill kill-chain">ProcessID</span>
  
  <span class="pill kill-chain">protocol</span>
  
  <span class="pill kill-chain">Protocol</span>
  
  <span class="pill kill-chain">protocol_version</span>
  
  <span class="pill kill-chain">punct</span>
  
  <span class="pill kill-chain">RuleName</span>
  
  <span class="pill kill-chain">signature</span>
  
  <span class="pill kill-chain">signature_id</span>
  
  <span class="pill kill-chain">source</span>
  
  <span class="pill kill-chain">SourceHostname</span>
  
  <span class="pill kill-chain">SourceIp</span>
  
  <span class="pill kill-chain">SourceIsIpv6</span>
  
  <span class="pill kill-chain">SourcePort</span>
  
  <span class="pill kill-chain">SourcePortName</span>
  
  <span class="pill kill-chain">sourcetype</span>
  
  <span class="pill kill-chain">splunk_server</span>
  
  <span class="pill kill-chain">src</span>
  
  <span class="pill kill-chain">src_ip</span>
  
  <span class="pill kill-chain">src_port</span>
  
  <span class="pill kill-chain">state</span>
  
  <span class="pill kill-chain">SystemTime</span>
  
  <span class="pill kill-chain">tag</span>
  
  <span class="pill kill-chain">tag::eventtype</span>
  
  <span class="pill kill-chain">ThreadID</span>
  
  <span class="pill kill-chain">timeendpos</span>
  
  <span class="pill kill-chain">timestartpos</span>
  
  <span class="pill kill-chain">transport</span>
  
  <span class="pill kill-chain">transport_dest_port</span>
  
  <span class="pill kill-chain">user</span>
  
  <span class="pill kill-chain">user_id</span>
  
  <span class="pill kill-chain">UserId</span>
  
  <span class="pill kill-chain">UtcTime</span>
  
  <span class="pill kill-chain">vendor_product</span>
  
  <span class="pill kill-chain">xmlns</span>
  
</div>

Example Log

1<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"><System><Provider Name="Linux-Sysmon" Guid="{ff032593-a8d3-4f13-b0d6-01fc615a0f97}"/><EventID>3</EventID><Version>5</Version><Level>4</Level><Task>3</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime="2022-08-31T18:16:47.177651000Z"/><EventRecordID>1068124</EventRecordID><Correlation/><Execution ProcessID="804" ThreadID="804"/><Channel>Linux-Sysmon/Operational</Channel><Computer>ip-10-0-76-137</Computer><Security UserId="0"/></System><EventData><Data Name="RuleName">-</Data><Data Name="UtcTime">2022-08-31 18:16:47.184</Data><Data Name="ProcessGuid">{ec21f57b-a58f-630f-05a2-4983a0550000}</Data><Data Name="ProcessId">7658</Data><Data Name="Image">/usr/bin/ncat</Data><Data Name="User">root</Data><Data Name="Protocol">tcp</Data><Data Name="Initiated">true</Data><Data Name="SourceIsIpv6">false</Data><Data Name="SourceIp">10.0.76.137</Data><Data Name="SourceHostname">-</Data><Data Name="SourcePort">53976</Data><Data Name="SourcePortName">-</Data><Data Name="DestinationIsIpv6">false</Data><Data Name="DestinationIp">10.0.76.44</Data><Data Name="DestinationHostname">-</Data><Data Name="DestinationPort">4444</Data><Data Name="DestinationPortName">-</Data></EventData></Event>

Required Output Fields

src
dest
dest_port
transport
process_name
app
user
process_id

Source: GitHub | Version: 1