GRE Protocol Traffic to External IP
This rule detects network connections using the GRE (Generic Routing Encapsulation) protocol to external IP addresses. GRE is often used for tunneling and can be leveraged by adversaries for command and control or data exfiltration, especially when communicating outside of internal network ranges.
Microsoft Sentinel (KQL)
