Windows WinLogon with Public Network Connection

MediumSplunk security contentThreat hunting

Windows WinLogon with Public Network Connection

The following analytic detects instances of Winlogon.exe, a critical Windows process, connecting to public IP addresses. This behavior is identified using Endpoint Detection and Response (EDR) telemetry, focusing on network connections made by Winlogon.exe. Under normal circumstances, Winlogon.exe should not connect to public IPs, and such activity may indicate a compromise, such as the BlackLotus bootkit attack. This detection is significant as it highlights potential system integrity breaches. If confirmed malicious, attackers could maintain persistence, bypass security measures, and compromise the system at a fundamental level.

ATT&CK coverage

Outside the enterprise matrix

T1542.003Bootkit 5 detections cover this technique

Detection requirements

Log source category: sysmon_eventid_1_and_sysmon_eventid_3

Detection logic

Published to signed-in readers

The query as its source wrote it, its canonical form, and the content hash that pins this exact revision.

Sign in to read it Create an account

Detection catalogue

ATT&CK coverage

Detection requirements

Detection logic