[EX] - Threat Hunting external connections attempts by internal Devices
When, for example, a printer, camera, IoT appliance, or other device suddenly makes outbound connections to countries such as China, Russia, or Iran, this may not be noise. The following detection helps identify connections from these specific device groups that we were not previously aware of and that could be exfiltrating information.
Microsoft Sentinel (KQL)
