✄𐘗
text code block:
✄𐘗authentication where host.os.type == "windows" and event.code in ("4624", "4625") and
 winlog.logon.type == "Network" and winlog.event_data.AuthenticationPackageName == "NTLM" and
 endswith~(user.name, "$") and user.name != "$" and
 source.ip != null and source.ip != "::1" and source.ip != "127.0.0.1" and

 /* Filter for a machine account that matches the hostname */
 startswith~(host.name, substring(user.name, 0, -1)) and

 /* Verify the machine account matches the full hostname, not just a prefix substring */
 (startswith~(substring(user.name, 0, -1), host.name) or startswith~(host.name, concat(substring(user.name, 0, -1), "."))) and

 /* Verify if the Source IP belongs to the host */
 not endswith(string(source.ip), string(host.ip)) and
 indexOf(string(host.ip), string(source.ip)) == null