Security teams utilizing Microsoft Defender XDR’s DeviceNetworkEvents table for threat detection may be inadvertently overlooking critical external network connections due to an IP address classification issue.
Understanding the FourToSixMapping Issue
The core of the problem lies in the FourToSixMapping, a RemoteIPType value that can allow public IP traffic to bypass detection logic that filters solely based on RemoteIPType == “Public”.
This oversight was highlighted during a Purple Team exercise by Detect FYI, where an attack simulation involving a binary to establish a covert command-and-control (C2) channel went undetected. Despite existing detection measures for this stage, no alert was triggered.
Technical Details of the Detection Gap
The issue traces back to a single query constraint:
text| where RemoteIPType == “Public”
This query fails to capture valid public IP connections logged as FourToSixMapping. Modern Windows applications often use dual-stack sockets, logging IPv4 addresses as IPv4-mapped IPv6 addresses in the format ::ffff:8.8.8.8, per RFC 4291 standards. However, these are tagged as FourToSixMapping by Defender XDR, rather than Public.
Filtering by RemoteIPType == “Public” thus results in a false-negative, with legitimate public traffic being missed. Even the KQL function ipv4_is_private() returns null for these addresses, further complicating detection.
Recommendations for Improved Detection
To address this, it is advised to normalize the IP addresses by removing the ::ffff: prefix from FourToSixMapping addresses before analysis:
text| extend RemoteIP = iff(RemoteIPType == “FourToSixMapping”, replace_string(RemoteIP, “::ffff:”, “”), RemoteIP)
This approach ensures accurate filtering and analysis by converting the address to a standard IPv4 format. Security teams can audit their systems using a validation query to compare RemoteIP values across both Public and FourToSixMapping types over historical data.
Key Takeaways for Security Teams
A significant lesson for defenders is to avoid filtering public communications based solely on RemoteIPType == “Public”, as this could exclude legitimate traffic linked to real attacks. Both Public and FourToSixMapping should be treated as valid indicators of external communication.
This vulnerability also underscores the importance of manual validation in detection engineering, especially since AI-assisted KQL suggestions and standard functions like ipv4_is_private() may not account for all nuances. Continuous refinement of detection logic to handle edge cases is crucial for robust cybersecurity.
