Microsoft Defender XDR Blind Spot Lets Public C2 Traffic Evade Detection Queries
ID: 3aa5d0c8-60bb-5cb1-8870-20e54fd81601
STIX ID: report--3aa5d0c8-60bb-5cb1-8870-20e54fd81601
Feed Name: GBHackers
Threat Score
Microsoft Defender XDR can misclassify IPv4-mapped IPv6 addresses as RemoteIPType == FourToSixMapping, so Kusto queries filtering only for RemoteIPType == "Public" may miss Internet-bound C2 and other outbound telemetry; defenders should include FourToSixMapping and normalize ::ffff: mappings before applying IPv4 checks to avoid detection gaps.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.