[WINDOWS-AUTH] Suspicious network login from non-RFC1918

alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[WINDOWS-AUTH] Suspicious network login from non-RFC1918"; program: *Security*; json_map:"event_id",".EventID"; json_map:"message",".RenderedDescription"; event_id: 4624; content: "Logon Type
| 3a
| 3"; parse_src_ip: 1; meta_content:!"Source Network Address
| 3a
| %sagan%",10.,192.168.,-,
| 3a 3a
| 1,127.0.0.1,172.16.,172.17.,172.18.,172.19.,172.20.,172.21.,172.22.,172.23.,172.24.,172.25.,172.26.,172.27.,172.28.,172.29.,172.30.,172.31,169.254,fe80,
| 3a 3a
| 1; meta_nocase; reference: url,findingbad.blogspot.cz/2017/12/a-few-of-my-favorite-things-continued.html; reference: url,www.quadrantsec.com/about/blog/using_jack_crooks_log_analysis_concepts_with_sagan; sid:5008556; metadata: created_on 2022_11_22, old_sid 5003377; classtype:suspicious-login; rev:6;)