Outbound Network Connection To Public IP Via Winlogon

Title: Outbound Network Connection To Public IP Via Winlogon
Status: test
Description:Detects a "winlogon.exe" process that initiate network communications with public IP addresses
References:
  -https://www.microsoft.com/en-us/security/blog/2023/04/11/guidance-for-investigating-attacks-using-cve-2022-21894-the-blacklotus-campaign/
Author: Christopher Peacock @securepeacock, SCYTHE @scythe_io
Date: 2023-04-28
modified:2024-03-12
Tags:

• -'attack.execution'
• -'attack.command-and-control'
• -'attack.stealth'
• -'attack.t1218.011'

Logsource:

• category: network_connection
• product: windows

Detection:
  selection:
    Image|endswith: '\winlogon.exe'
    Initiated: 'true'
  filter_main_local_ranges:
    DestinationIp|cidr:
      -'127.0.0.0/8'
      -'10.0.0.0/8'
      -'172.16.0.0/12'
      -'192.168.0.0/16'
      -'169.254.0.0/16'
      -'::1/128'
      -'fe80::/10'
      -'fc00::/7'

  condition:selection and not 1 of filter_main_*
Falsepositives:
  -Communication to other corporate systems that use IP addresses from public address spaces
Level: medium