Phoenix
Sigma IntelligenceBeta
Back to Rules
Detectionmediumtest

Outbound Network Connection To Public IP Via Winlogon

Detects a "winlogon.exe" process that initiate network communications with public IP addresses

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch
Christopher Peacock, SCYTHECreated Fri Apr 28Updated Tue Mar 127610a4ea-c06d-495f-a2ac-0a696abcfd3bwindows
Log Source
WindowsNetwork Connection
ProductWindows← raw: windows
CategoryNetwork Connection← raw: network_connection

Events for outbound and inbound network connections including DNS resolution.

Detection Logic
Detection Logic2 selectors
detection:
    selection:
        Image|endswith: '\winlogon.exe'
        Initiated: 'true'
    filter_main_local_ranges:
        DestinationIp|cidr:
            - '127.0.0.0/8'
            - '10.0.0.0/8'
            - '172.16.0.0/12'
            - '192.168.0.0/16'
            - '169.254.0.0/16'
            - '::1/128'  # IPv6 loopback
            - 'fe80::/10'  # IPv6 link-local addresses
            - 'fc00::/7'  # IPv6 private addresses
    condition: selection and not 1 of filter_main_*
False Positives

Communication to other corporate systems that use IP addresses from public address spaces

References
1
Resolving title…
microsoft.com
MITRE ATT&CK

Sub-techniques

T1218.011 · Rundll32
Rule Metadata
Rule ID
7610a4ea-c06d-495f-a2ac-0a696abcfd3b
Status
test
Level
medium
Type
Detection
Created
Fri Apr 28
Modified
Tue Mar 12
Author
Christopher Peacock, SCYTHE
Path
rules/windows/network_connection/net_connection_win_winlogon_net_connections.yml
Raw Tags
attack.defense-evasionattack.executionattack.command-and-controlattack.t1218.011
View on GitHub