There are still many companies using forward proxies and when analyzing traffic from endpoints this can be a bit challenging. This due to that the client connects to the forward proxy instead of the public endpoint like http://blog.sec-labs.com.
So instead of the public endpoint you would see that the process is connecting to the proxy.
Microsoft have engineers around this and by enabling the Network Protection feature in either Audit Mode or Block mode you can now see the public endpoint the process is actually communicating with behind the forward proxy.
Events that is coming from this type of detection is flagged with the a “NetworkProtection” tag.
If you want to use thees events generated when you do Hunting they are found under Network CommunicationEvents and if you know your proxy ip address you can get everything that has gone via the proxy with the following query.
NetworkCommunicationEvents
| where ActionType == “ConnectionSuccess” and RemoteIP != “ProxyIP”
If you want to enable Network Protection the below link will guide you through the different ways you can enable it. https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-exploit-guard/enable-network-protection
Happy Hunting