Windows Office Apps Initiating Network Connections to Non-Common Ports
Alerts on network connections initiated by Windows Office apps to destination ports not in the common port set.
- Product
- windows
- Category
- network_connection
- Author
- X__Junior (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-07-12
- Updated
- 2026-07-31
What it detects
This rule identifies when common Microsoft Office executables (Word, Excel, PowerPoint, or Outlook) initiate outbound network connections to destinations using ports other than a predefined set of common service ports. Such behavior can indicate attacker-controlled command-and-control or data exfiltration attempts that blend in by starting from legitimate office processes. It relies on Windows network connection telemetry including the initiating process image path and destination port.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Office Apps Initiating Network Connections to Non-Common Ports
id: 208febdb-d690-4045-aeda-cf95c6d4db36
status: test
description: This rule identifies when common Microsoft Office executables (Word, Excel, PowerPoint, or Outlook) initiate outbound network connections to destinations using ports other than a predefined set of common service ports. Such behavior can indicate attacker-controlled command-and-control or data exfiltration attempts that blend in by starting from legitimate office processes. It relies on Windows network connection telemetry including the initiating process image path and destination port.
references:
- https://blogs.blackberry.com/en/2023/07/romcom-targets-ukraine-nato-membership-talks-at-nato-summit
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_office_uncommon_ports.yml
author: X__Junior (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-07-12
modified: 2025-10-17
tags:
- attack.command-and-control
- attack.stealth
logsource:
category: network_connection
product: windows
detection:
selection:
Initiated: "true"
Image|endswith:
- \excel.exe
- \outlook.exe
- \powerpnt.exe
- \winword.exe
- \wordview.exe
filter_main_common_ports:
DestinationPort:
- 53
- 80
- 139
- 389
- 443
- 445
- 3268
filter_main_outlook_ports:
Image|contains: :\Program Files\Microsoft Office\
Image|endswith: \OUTLOOK.EXE
DestinationPort:
- 143
- 465
- 587
- 993
- 995
condition: selection and not 1 of filter_main_*
falsepositives:
- Other ports can be used, apply additional filters accordingly
level: medium
license: DRL-1.1
related:
- id: 3b5ba899-9842-4bc2-acc2-12308498bf42
type: derived