Failed Logon From Public IP

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•2•0•32

Detects a failed logon attempt from a public IP address on a Windows system. This can indicate an attempt to gain unauthorized access, potentially through brute-force attacks or credential stuffing, especially if the system is not intended to be exposed to the internet for direct login.