Network & File Activity (EID 3 & 11)

What is it?

Event ID 3 records a process's network connection (destination IP/port, and which process made it). Event ID 11 records file creation. Together they show where a process reached out and what it wrote.

Why it matters

Attribution is the point: EID 3 ties a suspicious outbound connection to the exact process, so 'something is beaconing' becomes 'THIS process is beaconing to THAT IP'. EID 11 catches dropped tooling.

Where you see it

EID 3: Image (the process) + DestinationIp + DestinationPort. EID 11: Image + TargetFilename (where a file was written).

What normal looks like

Browsers and updaters connecting to known services; apps writing to their own data folders.

What suspicious looks like

powershell or a Public-path binary connecting to an unknown external IP, or a document-launched process writing an executable to a user-writable path.

How analysts investigate

When a process is suspect, pull its EID 3 (who did it talk to?) and EID 11 (what did it drop?) to complete the picture beyond execution.

Common beginner mistakes

Seeing an outbound connection without attributing it to the responsible process.
Ignoring where a file was written — a Public/Temp path is itself suspicious.

Who talked to whom, and what got dropped

  EID3 (network):  powershell.exe → 45.9.148.200:443   ← attributed C2 connection
  EID11 (file):    powershell.exe wrote C:\Users\Public\svc.exe
  now the story: the ps process BOTH reached out AND dropped a binary
  attribution (which process) is what makes it actionable

EID 3 attributes a connection to a process; EID 11 shows what it wrote — together, intent.

Quick check

What does Event ID 3 add over just seeing a firewall connection?

A quick self-check — it doesn't affect your XP or progress.