Office Application Initiated Network Connection Over Unusual Ports (via network_connection)

title: Office Application Initiated Network Connection Over Unusual Ports (via network_connection)
id: d430a311-ff0a-597d-abe9-1c0dad2f850c
status: stable
description: This rule detects an office suit application (Word, Excel, PowerPoint, Outlook) communicating to target systems over uncommon ports.
references:
    - https://blogs.blackberry.com/en/2023/07/romcom-targets-ukraine-nato-membership-talks-at-nato-summit
author: Huntrule Team
date: 2026-06-20
tags:
    - attack.command-and-control
    - attack.stealth
    - attack.t1571
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        Initiated: 'true'
        Image|endswith:
            - '\excel.exe'
            - '\outlook.exe'
            - '\powerpnt.exe'
            - '\winword.exe'
            - '\wordview.exe'
    filter_main_common_ports:
        DestinationPort:
            - 53
            - 80
            - 139
            - 389
            - 443
            - 445
            - 3268
    filter_main_outlook_ports:
        Image|contains: ':\Program Files\Microsoft Office\'
        Image|endswith: '\OUTLOOK.EXE'
        DestinationPort:
            - 143
            - 465
            - 587
            - 993
            - 995
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Unknown
level: medium