Suspicious Outbound Network Connection To Public IP Through Winlogon (via network_connection)

title: Suspicious Outbound Network Connection To Public IP Through Winlogon (via network_connection)
id: b96620aa-6bac-54d7-88c3-59e5f6cc572a
status: stable
description: This rule detects a "winlogon.exe" process that initiate network communications with public IP addresses
references:
    - https://attack.mitre.org/techniques/T1218/011/
    - https://www.microsoft.com/en-us/security/blog/2023/04/11/guidance-for-investigating-attacks-using-cve-2022-21894-the-blacklotus-campaign/
author: Huntrule Team
date: 2026-05-08
tags:
    - attack.execution
    - attack.command-and-control
    - attack.stealth
    - attack.t1218.011
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        Image|endswith: '\winlogon.exe'
        Initiated: 'true'
    filter_main_local_ranges:
        DestinationIp|cidr:
            - '127.0.0.0/8'
            - '10.0.0.0/8'
            - '172.16.0.0/12'
            - '192.168.0.0/16'
            - '169.254.0.0/16'
            - '::1/128'
            - 'fe80::/10'
            - 'fc00::/7'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Unknown
level: medium