Sigma medium test sigma

Outbound Network Connection To Public IP Via Winlogon

Detects a "winlogon.exe" process that initiate network communications with public IP addresses

View Source

Detection Logic

{
  "selection": {
    "Image
| endswith": "\\winlogon.exe",
    "Initiated": "true"
  },
  "filter_main_local_ranges": {
    "DestinationIp
| cidr": [
      "127.0.0.0/8",
      "10.0.0.0/8",
      "172.16.0.0/12",
      "192.168.0.0/16",
      "169.254.0.0/16",
      "::1/128",
      "fe80::/10",
      "fc00::/7"
    ]
  },
  "condition": "selection and not 1 of filter_main_*"
}

False Positives

  • ⚠ Communication to other corporate systems that use IP addresses from public address spaces

Field Validations

Loading…

Comments (0)

Loading comments...