huntrule

Windows Office Apps Initiate Outbound Network Connections to Non-Private IPs

Alerts when Office app processes initiate outbound TCP/HTTP(S)/mail connections to non-private IPs, excluding common private and known provider ranges.

FreeReviewedSigma · Medium · v2
Product
windows
Category
network_connection
Author
Christopher Peacock '@securepeacock', SCYTHE '@scythe_io', Florian Roth (Nextron Systems), Tim Shelton, Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2021-11-10
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Execution

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule identifies Windows Office applications (Excel, Outlook, PowerPoint, Word) that initiate outbound network connections to destination IPs outside configured private, loopback, and link-local ranges. Attackers may use Office processes to establish external connectivity during exploitation or follow-on activity, making unexpected outbound traffic from these apps an important signal. The detection relies on network connection telemetry containing the initiating image path, the connection direction (initiated), and the destination IP/port (and selected destination hostnames) to filter known local and allowlisted ranges.

Reporting behind it

Related detections9 linkedT1203 — drag to rearrange
Suspicious Chrome Browser Process Spawned by Outlook Indicating Sandbox Escape
Suspicious Equation Editor Child Process via Process Creation
Malicious MSDT Command Line Invoking Follina Payload (via process_creation)
Malicious WPS Office ksoqing Protocol Handler Exploitation via Process Creation
Malicious Startup LNK Dropped by WinRAR via CVE-2025-8088 Path Traversal
Malicious Equation Editor Child Process Indicating Exploit
Malicious Foomatic-Rip Filter Spawning Shell via CUPS Exploitation
Suspicious Child Process Spawned by WinRAR via Process Creation
Malicious Script Execution from WinRAR Extraction Directory via CVE-2023-38831
Windows Office Apps Initiate Outbound Network Connections to Non-Private IPs
Pivot detection · T1203 · 9 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.