[WINDOWS-AUTH] Suspicious network login

alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[WINDOWS-AUTH] Suspicious network login"; program: *Security*; json_map:"event_id",".EventID"; json_map:"message",".RenderedDescription"; event_id: 4624; content: "Logon Type
| 3a
| 3"; pcre: "/^((?!Account Name: (.*)\$ ).)*$/"; content:!"Workstation Name
| 3a
| Source Network Address
| 3a
| "; reference: url,indingbad.blogspot.cz/2017/12/a-few-of-my-favorite-things-continued.html; reference: url,www.quadrantsec.com/about/blog/using_jack_crooks_log_analysis_concepts_with_sagan; classtype:suspicious-login; sid:5008555; metadata: created_on 2022_11_22, old_sid 5003376; rev:2;)