huntrule

Suspicious Excel Outbound Network Connection

PremiumReviewedSigma · Medium · v1
Product
windows
Category
network_connection
Author
HuntRule
Published
2026-05-11
Updated
2026-08-28
AnalysisDetection

ATT&CK techniques

Priv Esc → C2

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule detects Excel.exe initiating an outbound network connection, which is unusual for a spreadsheet application that has no child process. In the WithSecure Initial Access Lab 4 an Excel 4.0 SLK macro injects meterpreter shellcode into Excel itself which then beacons over HTTPS to a non-Microsoft address. Attackers keep the malicious code inside the Office host to avoid spawning a suspicious child process.

Reporting behind it

Related detections9 linkedT1071.001 — drag to rearrange
Suspicious RuntimeBroker Network Connection via Loki Mythic Agent
Suspicious Network Connection From wabmig.exe (Turian Injection)
Suspicious netsh Outbound Network Connection from IDAT Loader Injection
Suspicious Outbound Network Connection from Windows Dialer Process
Malicious Data Exfiltration via curl with Stealer Specific BuildID Header
Suspicious Shadow File Exfiltration Over Dev TCP on Linux via Process Creation (via process_creation)
Suspicious Netcat Reverse Shell via Named Pipe on Linux via Process Creation (via process_creation)
Suspicious PowerShell Shellcode Loader via Function Pointer Delegate
Malicious GenAI Browser Extension C2 and PAC Redirection (via proxy)
Suspicious Excel Outbound Network Connection
Pivot detection · T1071.001 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.