Failed Logon From Public IP — Detection Rule

Detects a failed logon attempt from a public IP. A login from a public IP can indicate a misconfigured firewall or network boundary.

Read the full analysis on IntelFusions