Hayabusa medium test sigma

Outbound Network Connection To Public IP Via Winlogon

Detects a "winlogon.exe" process that initiate network communications with public IP addresses

View Source

Detection Logic

{
  "network_connection": {
    "EventID": 5156,
    "Channel": "Security"
  },
  "selection": {
    "Application
| endswith": "\\winlogon.exe",
    "Direction": "%%14593"
  },
  "filter_main_local_ranges": {
    "DestAddress
| cidr": [
      "127.0.0.0/8",
      "10.0.0.0/8",
      "172.16.0.0/12",
      "192.168.0.0/16",
      "169.254.0.0/16",
      "::1/128",
      "fe80::/10",
      "fc00::/7"
    ]
  },
  "condition": "network_connection and (selection and not 1 of filter_main_*)"
}

False Positives

  • ⚠ Communication to other corporate systems that use IP addresses from public address spaces

Field Validations

Loading…

Comments (0)

Loading comments...