Microsoft Defender XDR Blind Spot Can Hide Public Connections Behind FourToSixMapping

Detect FYI identified a Defender XDR logging/detection blind spot where IPv4-mapped IPv6 addresses (e.g., ::ffff:8.8.8.8) are classified as RemoteIPType == "FourToSixMapping" rather than "Public", causing detection queries that filter only on RemoteIPType == "Public" to miss real external connections (including covert C2). The report explains the technical cause, demonstrates KQL pitfalls, and recommends normalizing the address (strip the ::ffff: prefix) and treating both Public and FourToSixMapping as external when building detections.