Logon/Failed Logon from Threat Intel IP

nomit vyas@xoxo

•updated Jun 24, 2026•2•0•6

Detects successful or failed logon attempts originating from IP addresses identified as associated with botnets, C2 infrastructure, or proxies by threat intelligence feeds. This indicates potential malicious activity or compromised accounts.