Outbound Network Connection To Public IP Via Winlogon — Detection Rule
Detects a "winlogon.exe" process that initiate network communications with public IP addresses
Detects a "winlogon.exe" process that initiate network communications with public IP addresses