Windows Winlogon Outbound Network Connections to Public IPs

title: Windows Winlogon Outbound Network Connections to Public IPs
id: ebf3ca34-f1eb-42ea-ab6b-4df078d5431d
status: test
description: Flags outbound network connections initiated by winlogon.exe where the destination is not within common local, private, link-local, or loopback IP ranges. Attackers can abuse legitimate Windows processes to blend outbound traffic and establish command-and-control or exfiltration channels. This detection relies on Windows network connection telemetry that includes the initiating process image, destination IP, and connection initiation status.
references:
  - https://www.microsoft.com/en-us/security/blog/2023/04/11/guidance-for-investigating-attacks-using-cve-2022-21894-the-blacklotus-campaign/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_winlogon_net_connections.yml
author: Christopher Peacock @securepeacock, SCYTHE @scythe_io, Huntrule Team
date: 2023-04-28
modified: 2024-03-12
tags:
  - attack.execution
  - attack.command-and-control
  - attack.stealth
  - attack.t1218.011
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|endswith: \winlogon.exe
    Initiated: "true"
  filter_main_local_ranges:
    DestinationIp|cidr:
      - 127.0.0.0/8
      - 10.0.0.0/8
      - 172.16.0.0/12
      - 192.168.0.0/16
      - 169.254.0.0/16
      - ::1/128
      - fe80::/10
      - fc00::/7
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Communication to other corporate systems that use IP addresses from public address spaces
level: medium
license: DRL-1.1
related:
  - id: 7610a4ea-c06d-495f-a2ac-0a696abcfd3b
    type: derived