60106, 60118, 60119, 92651, 92652, 92653, 92657, 67022, 67024 ^4624$ ^2$|^10$|^11$ ^[^$]+$ 8 pm - 6 am ISACA B28: interactive logon of $(win.eventdata.targetUserName) on $(win.system.computer) outside business hours (type $(win.eventdata.logonType), from $(win.eventdata.ipAddress)) T1078 isaca_b28,authentication_success, 60106, 60118, 60119, 92651, 92652, 92653, 92657, 67022, 67024 ^4624$ ^2$|^10$|^11$ ^[^$]+$ weekends ISACA B28: interactive logon of $(win.eventdata.targetUserName) on $(win.system.computer) on a weekend (type $(win.eventdata.logonType), from $(win.eventdata.ipAddress)) T1078 isaca_b28,authentication_success, 5715 8 pm - 6 am ISACA B28: SSH logon of $(dstuser) from $(srcip) outside business hours T1078 isaca_b28,authentication_success,