Windows winlogon.exe initiating outbound connections to public IPs

title: Windows winlogon.exe initiating outbound connections to public IPs
id: ebf3ca34-f1eb-42ea-ab6b-4df078d5431d
status: test
description: This rule identifies network connections where winlogon.exe initiates outbound traffic to destination IPs outside common local and private ranges. Such behavior is important because the Windows logon process typically does not make external connections, and attackers may abuse trusted system processes for command-and-control. Telemetry relies on Windows network connection events containing the process image path, an initiated flag, and the destination IP.
references:
  - https://www.microsoft.com/en-us/security/blog/2023/04/11/guidance-for-investigating-attacks-using-cve-2022-21894-the-blacklotus-campaign/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_winlogon_net_connections.yml
author: Christopher Peacock @securepeacock, SCYTHE @scythe_io, Huntrule Team
date: 2023-04-28
modified: 2024-03-12
tags:
  - attack.execution
  - attack.command-and-control
  - attack.stealth
  - attack.t1218.011
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|endswith: \winlogon.exe
    Initiated: "true"
  filter_main_local_ranges:
    DestinationIp|cidr:
      - 127.0.0.0/8
      - 10.0.0.0/8
      - 172.16.0.0/12
      - 192.168.0.0/16
      - 169.254.0.0/16
      - ::1/128
      - fe80::/10
      - fc00::/7
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Communication to other corporate systems that use IP addresses from public address spaces
level: medium
license: DRL-1.1
related:
  - id: 7610a4ea-c06d-495f-a2ac-0a696abcfd3b
    type: derived