Windows Office Apps Initiate Network Connections to Uncommon Destination Ports

title: Windows Office Apps Initiate Network Connections to Uncommon Destination Ports
id: 208febdb-d690-4045-aeda-cf95c6d4db36
status: test
description: This rule flags when a Windows Office application (WINWORD.EXE, EXCEL.EXE, POWERPNT.EXE, or OUTLOOK.EXE) initiates a network connection to a destination port outside commonly used service ports. Attackers often use normal-looking user applications to blend command-and-control or data exfiltration traffic, so uncommon port usage is a useful anomaly signal. Telemetry relies on Windows network connection events including the initiating process image path and destination port, with additional filtering that treats Outlook standard mail ports separately.
references:
  - https://blogs.blackberry.com/en/2023/07/romcom-targets-ukraine-nato-membership-talks-at-nato-summit
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_office_uncommon_ports.yml
author: X__Junior (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-07-12
modified: 2025-10-17
tags:
  - attack.command-and-control
  - attack.stealth
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Initiated: "true"
    Image|endswith:
      - \excel.exe
      - \outlook.exe
      - \powerpnt.exe
      - \winword.exe
      - \wordview.exe
  filter_main_common_ports:
    DestinationPort:
      - 53
      - 80
      - 139
      - 389
      - 443
      - 445
      - 3268
  filter_main_outlook_ports:
    Image|contains: :\Program Files\Microsoft Office\
    Image|endswith: \OUTLOOK.EXE
    DestinationPort:
      - 143
      - 465
      - 587
      - 993
      - 995
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Other ports can be used, apply additional filters accordingly
level: medium
license: DRL-1.1
related:
  - id: 3b5ba899-9842-4bc2-acc2-12308498bf42
    type: derived