Defender's Remote Connections Blind Spot: FourToSixMapping

This blog post explains how overly constrained KQL queries in Microsoft Defender XDR can generate false negatives by filtering on RemoteIPType == "Public" or relying on ipv4_is_private(), which returns null for IPv4-mapped IPv6 addresses (FourToSixMapping). The author demonstrates the issue with examples and provides KQL fixes and normalization (removing the "::ffff:" prefix) to ensure external communications logged as FourToSixMapping are detected.