Outbound Connections from Devices on Public Wi-Fi Networks
This rule identifies devices connected to Wi-Fi networks with public IP addresses and correlates those connections with outbound network events. It aims to provide process-level context for connections originating from such network configurations, including geolocation of both local and remote IPs. This could indicate unusual or unauthorized network activity, potentially related to command and control or data exfiltration from devices on less secure network segments.
Microsoft Sentinel (KQL)
