[WINDOWS-GEOIP] Attempted explicit windows logon

alert any $HOME_NET any -> $EXTERNAL_NET any (msg: "[WINDOWS-GEOIP] Attempted explicit windows logon"; json_map:"event_id",".EventID"; json_map:"username",".Computer"; json_map:"message",".RenderedDescription"; event_id: 4648,552; content: "Target"; content: "Process"; country_code: track by_src, isnot $HOME_COUNTRY; program: *Security*; parse_src_ip: 1; xbits: set,recon,track ip_src, expire 86400; threshold: type suppress, track by_src, count 2, seconds 300; content:!"0.0 Port
| 3a
| 0"; default_proto: tcp; metadata: created_on 2022_11_22, endpoint_command FIREWALL_BLOCK_SRC_IP; classtype: successful-user; sid:5008672; metadata: created_on 2022_11_22, old_sid 5002340; rev:9;)