Windows Winlogon Outbound Network Connections to Public IPs

Flags outbound connections initiated by winlogon.exe to non-local public destination IPs on Windows.

FreeReviewedSigma · Medium · v2

Product: windows
Category: network_connection
Author: Christopher Peacock @securepeacock, SCYTHE @scythe_io (SigmaHQ), DRL 1.1
Published: 2023-04-28
Updated: 2026-07-31

ATT&CK techniques

Defense Evasion

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
- T1218.011Rundll32
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

Flags outbound network connections initiated by winlogon.exe where the destination is not within common local, private, link-local, or loopback IP ranges. Attackers can abuse legitimate Windows processes to blend outbound traffic and establish command-and-control or exfiltration channels. This detection relies on Windows network connection telemetry that includes the initiating process image, destination IP, and connection initiation status.

Reporting behind it

Related detections9 linkedT1218.011 — drag to rearrange

Andromeda Loader Execution via Rundll32 Desktop.ini Ordinal

Suspicious rundll32 Execution of sqlite3 DLL by Ordinal with TLB Argument

Malicious Zardoor Backdoor Execution via rundll32 (via process_creation)

Malicious Rundll32 Loading an Export From a User Path (via process_creation)

Renamed Regsvr32 or Rundll32 Loading a DLL With a Non-Standard Extension (via process_creation)

Malicious Rundll32 DllRegisterServer Execution From a User-Writable Path (via process_creation)

IMEEX Framework DLL Execution via Rundll32 Loading imaadp (via process_creation)

Suspicious Persistence via pcalua Launching rundll32 Control_RunDLL

Suspicious Rundll32 Executing DLL Start Export With Control Flags

Windows Winlogon Outbound Network Connections to Public IPs

Pivot detection · T1218.011 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-winlogon-exe-initiating-outbound-connections-to-public-ips-7610a4ea

title: Windows Winlogon Outbound Network Connections to Public IPs
id: ebf3ca34-f1eb-42ea-ab6b-4df078d5431d
status: test
description: Flags outbound network connections initiated by winlogon.exe where the destination is not within common local, private, link-local, or loopback IP ranges. Attackers can abuse legitimate Windows processes to blend outbound traffic and establish command-and-control or exfiltration channels. This detection relies on Windows network connection telemetry that includes the initiating process image, destination IP, and connection initiation status.
references:
  - https://www.microsoft.com/en-us/security/blog/2023/04/11/guidance-for-investigating-attacks-using-cve-2022-21894-the-blacklotus-campaign/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_winlogon_net_connections.yml
author: Christopher Peacock @securepeacock, SCYTHE @scythe_io, Huntrule Team
date: 2023-04-28
modified: 2024-03-12
tags:
  - attack.execution
  - attack.command-and-control
  - attack.stealth
  - attack.t1218.011
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|endswith: \winlogon.exe
    Initiated: "true"
  filter_main_local_ranges:
    DestinationIp|cidr:
      - 127.0.0.0/8
      - 10.0.0.0/8
      - 172.16.0.0/12
      - 192.168.0.0/16
      - 169.254.0.0/16
      - ::1/128
      - fe80::/10
      - fc00::/7
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Communication to other corporate systems that use IP addresses from public address spaces
level: medium
license: DRL-1.1
related:
  - id: 7610a4ea-c06d-495f-a2ac-0a696abcfd3b
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL