[WINDOWS-AUTH] Suspicious network login

alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[WINDOWS-AUTH] Suspicious network login"; program: *Security*; event_id: 4624; content: "Logon Type
| 3a
| 3"; content:!"
| 24
| Account Domain
| 3a
| "; content:!"Workstation Name
| 3a
| Source Network Address
| 3a
| "; reference: url,indingbad.blogspot.cz/2017/12/a-few-of-my-favorite-things-continued.html; reference: url,www.quadrantsec.com/about/blog/using_jack_crooks_log_analysis_concepts_with_sagan; classtype:suspicious-login; sid:5003376; rev:3;)