Communication To Greensnowco IP Blacklist
Query
let BLgreensnow = externaldata(IPaddr: string)[@"https://blocklist.greensnow.co/greensnow.txt"] with (format="txt");
DeviceNetworkEvents
| where ActionType == "ConnectionSuccess"
| where RemoteIP in (BLgreensnow)Explanation
This query is checking for successful network connections made by devices to any IP addresses listed in the "greensnow" blocklist.