Windows Office Apps Initiating Network Connections to Non-Common Ports

title: Windows Office Apps Initiating Network Connections to Non-Common Ports
id: 208febdb-d690-4045-aeda-cf95c6d4db36
status: test
description: This rule identifies when common Microsoft Office executables (Word, Excel, PowerPoint, or Outlook) initiate outbound network connections to destinations using ports other than a predefined set of common service ports. Such behavior can indicate attacker-controlled command-and-control or data exfiltration attempts that blend in by starting from legitimate office processes. It relies on Windows network connection telemetry including the initiating process image path and destination port.
references:
  - https://blogs.blackberry.com/en/2023/07/romcom-targets-ukraine-nato-membership-talks-at-nato-summit
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_office_uncommon_ports.yml
author: X__Junior (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-07-12
modified: 2025-10-17
tags:
  - attack.command-and-control
  - attack.stealth
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Initiated: "true"
    Image|endswith:
      - \excel.exe
      - \outlook.exe
      - \powerpnt.exe
      - \winword.exe
      - \wordview.exe
  filter_main_common_ports:
    DestinationPort:
      - 53
      - 80
      - 139
      - 389
      - 443
      - 445
      - 3268
  filter_main_outlook_ports:
    Image|contains: :\Program Files\Microsoft Office\
    Image|endswith: \OUTLOOK.EXE
    DestinationPort:
      - 143
      - 465
      - 587
      - 993
      - 995
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Other ports can be used, apply additional filters accordingly
level: medium
license: DRL-1.1
related:
  - id: 3b5ba899-9842-4bc2-acc2-12308498bf42
    type: derived