Outbound Network Connection To Public IP Via Winlogon

{
  "network_connection": {
    "EventID": 3,
    "Channel": "Microsoft-Windows-Sysmon/Operational"
  },
  "selection": {
    "Image
| endswith": "\\winlogon.exe",
    "Initiated": "true"
  },
  "filter_main_local_ranges": {
    "DestinationIp
| cidr": [
      "127.0.0.0/8",
      "10.0.0.0/8",
      "172.16.0.0/12",
      "192.168.0.0/16",
      "169.254.0.0/16",
      "::1/128",
      "fe80::/10",
      "fc00::/7"
    ]
  },
  "condition": "network_connection and (selection and not 1 of filter_main_*)"
}

False Positives

• ⚠ Communication to other corporate systems that use IP addresses from public address spaces