Windows Office Apps Initiate Outbound Network Connections to Non-Private IPs

ATT&CK techniques

Execution

Recon
Resource Dev
Initial Access
Execution
- T1203Exploitation for Client Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies Windows Office applications (Excel, Outlook, PowerPoint, Word) that initiate outbound network connections to destination IPs outside configured private, loopback, and link-local ranges. Attackers may use Office processes to establish external connectivity during exploitation or follow-on activity, making unexpected outbound traffic from these apps an important signal. The detection relies on network connection telemetry containing the initiating image path, the connection direction (initiated), and the destination IP/port (and selected destination hostnames) to filter known local and allowlisted ranges.

Reporting behind it

Related detections9 linkedT1203 — drag to rearrange

Malicious Script Execution from WinRAR Extraction Directory via CVE-2023-38831

Suspicious Execution From WinRAR Temporary Extraction Path via Command Line (via process_creation)

Malicious Shell Execution via Foomatic-rip Print Filter through CUPS Exploit

Suspicious Network Connection From CUPS Foomatic-Rip Child Process

Antivirus signatures matching APT malware naming patterns

Antivirus Remote Access Tool Signature Matches Known RAT Names

Malicious Microsoft Word Spawning Anomalous Child Process via CVE-2023-36884 (via process_creation)

Possible ExifTool CVE-2026-3102 Command Injection via Child Process Spawn (via process_creation)

Malicious Equation Editor Child Process Execution via process_creation

Windows Office Apps Initiate Outbound Network Connections to Non-Private IPs

Pivot detection · T1203 · 9 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-office-apps-initiating-network-connections-to-external-non-private-ips-75e33ce3

title: Windows Office Apps Initiate Outbound Network Connections to Non-Private IPs
id: 3939128a-7ac8-4dd5-9642-6ca0ca71948d
status: test
description: This rule identifies Windows Office applications (Excel, Outlook, PowerPoint, Word) that initiate outbound network connections to destination IPs outside configured private, loopback, and link-local ranges. Attackers may use Office processes to establish external connectivity during exploitation or follow-on activity, making unexpected outbound traffic from these apps an important signal. The detection relies on network connection telemetry containing the initiating image path, the connection direction (initiated), and the destination IP/port (and selected destination hostnames) to filter known local and allowlisted ranges.
references:
  - https://corelight.com/blog/detecting-cve-2021-42292
  - https://learn.microsoft.com/de-de/microsoft-365/enterprise/urls-and-ip-address-ranges?view=o365-worldwide
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_office_outbound_non_local_ip.yml
author: Christopher Peacock '@securepeacock', SCYTHE '@scythe_io', Florian Roth (Nextron Systems), Tim Shelton, Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2021-11-10
modified: 2025-10-17
tags:
  - attack.execution
  - attack.t1203
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|endswith:
      - \excel.exe
      - \outlook.exe
      - \powerpnt.exe
      - \winword.exe
      - \wordview.exe
    Initiated: "true"
  filter_main_local_ranges:
    DestinationIp|cidr:
      - 127.0.0.0/8
      - 10.0.0.0/8
      - 172.16.0.0/12
      - 192.168.0.0/16
      - 169.254.0.0/16
      - ::1/128
      - fe80::/10
      - fc00::/7
  filter_main_msrange_generic:
    DestinationIp|cidr:
      - 2.16.56.0/23
      - 2.17.248.0/21
      - 13.107.240.0/21
      - 20.184.0.0/13
      - 23.61.224.0/20
      - 20.192.0.0/10
      - 23.72.0.0/13
      - 23.3.88.0/22
      - 23.216.132.0/22
      - 40.76.0.0/14
      - 51.10.0.0/15
      - 51.103.0.0/16
      - 51.104.0.0/15
      - 51.142.136.0/22
      - 52.160.0.0/11
      - 95.101.96.0/21
      - 204.79.197.0/24
  filter_main_msrange_exchange_1:
    DestinationIp|cidr:
      - 13.107.4.0/22
      - 13.107.6.152/31
      - 13.107.18.10/31
      - 13.107.42.0/23
      - 13.107.128.0/22
      - 23.35.224.0/20
      - 23.53.40.0/22
      - 23.103.160.0/20
      - 23.216.76.0/22
      - 40.96.0.0/13
      - 40.104.0.0/15
      - 52.96.0.0/14
      - 131.253.33.215/32
      - 132.245.0.0/16
      - 150.171.32.0/22
      - 204.79.197.215/32
      - 2603:1006::/40
      - 2603:1016::/36
      - 2603:1026::/36
      - 2603:1036::/36
      - 2603:1046::/36
      - 2603:1056::/36
      - 2620:1ec:4::152/128
      - 2620:1ec:4::153/128
      - 2620:1ec:c::10/128
      - 2620:1ec:c::11/128
      - 2620:1ec:d::10/128
      - 2620:1ec:d::11/128
      - 2620:1ec:8f0::/46
      - 2620:1ec:900::/46
      - 2620:1ec:a92::152/128
      - 2620:1ec:a92::153/128
    DestinationPort:
      - 80
      - 443
  filter_main_msrange_exchange_2:
    DestinationIp|cidr:
      - 13.107.6.152/31
      - 13.107.18.10/31
      - 13.107.128.0/22
      - 23.103.160.0/20
      - 40.96.0.0/13
      - 40.104.0.0/15
      - 52.96.0.0/14
      - 131.253.33.215/32
      - 132.245.0.0/16
      - 150.171.32.0/22
      - 204.79.197.215/32
      - 2603:1006::/40
      - 2603:1016::/36
      - 2603:1026::/36
      - 2603:1036::/36
      - 2603:1046::/36
      - 2603:1056::/36
      - 2620:1ec:4::152/128
      - 2620:1ec:4::153/128
      - 2620:1ec:c::10/128
      - 2620:1ec:c::11/128
      - 2620:1ec:d::10/128
      - 2620:1ec:d::11/128
      - 2620:1ec:8f0::/46
      - 2620:1ec:900::/46
      - 2620:1ec:a92::152/128
      - 2620:1ec:a92::153/128
    DestinationPort:
      - 143
      - 587
      - 993
      - 995
    Protocol: tcp
  filter_main_msrange_exchange_3:
    DestinationIp|cidr:
      - 40.92.0.0/15
      - 40.107.0.0/16
      - 52.100.0.0/14
      - 52.238.78.88/32
      - 104.47.0.0/17
      - 2a01:111:f400::/48
      - 2a01:111:f403::/48
    DestinationPort: 443
  filter_main_msrange_exchange_4:
    DestinationIp|cidr:
      - 40.92.0.0/15
      - 40.107.0.0/16
      - 52.100.0.0/14
      - 52.238.78.88/32
      - 104.47.0.0/17
      - 2a01:111:f400::/48
      - 2a01:111:f403::/48
    DestinationPort: 25
  filter_main_msrange_sharepoint_1:
    DestinationIp|cidr:
      - 13.107.136.0/22
      - 40.108.128.0/17
      - 52.104.0.0/14
      - 104.146.128.0/17
      - 150.171.40.0/22
      - 2603:1061:1300::/40
      - 2620:1ec:8f8::/46
      - 2620:1ec:908::/46
      - 2a01:111:f402::/48
    DestinationPort:
      - 80
      - 443
    Protocol: tcp
  filter_main_msrange_office_1:
    DestinationIp|cidr:
      - 13.107.6.171/32
      - 13.107.18.15/32
      - 13.107.140.6/32
      - 20.64.0.0/10
      - 52.108.0.0/14
      - 52.244.37.168/32
      - 2603:1006:1400::/40
      - 2603:1016:2400::/40
      - 2603:1026:2400::/40
      - 2603:1036:2400::/40
      - 2603:1046:1400::/40
      - 2603:1056:1400::/40
      - 2603:1063:2000::/38
      - 2620:1ec:c::15/128
      - 2620:1ec:8fc::6/128
      - 2620:1ec:a92::171/128
      - 2a01:111:f100:2000::a83e:3019/128
      - 2a01:111:f100:2002::8975:2d79/128
      - 2a01:111:f100:2002::8975:2da8/128
      - 2a01:111:f100:7000::6fdd:6cd5/128
      - 2a01:111:f100:a004::bfeb:88cf/128
    DestinationPort:
      - 80
      - 443
    Protocol: tcp
  filter_main_msrange_office_2:
    DestinationIp|cidr:
      - 172.128.0.0/10
      - 20.20.32.0/19
      - 20.103.156.88/32
      - 20.190.128.0/18
      - 20.231.128.0/19
      - 40.126.0.0/18
      - 57.150.0.0/15
      - 2603:1006:2000::/48
      - 2603:1007:200::/48
      - 2603:1016:1400::/48
      - 2603:1017::/48
      - 2603:1026:3000::/48
      - 2603:1027:1::/48
      - 2603:1036:3000::/48
      - 2603:1037:1::/48
      - 2603:1046:2000::/48
      - 2603:1047:1::/48
      - 2603:1056:2000::/48
      - 2603:1057:2::/48
    DestinationPort:
      - 80
      - 443
    Protocol: tcp
  filter_main_msrange_office_3:
    DestinationIp|cidr:
      - 13.64.0.0/11
      - 13.107.6.192/32
      - 13.107.9.192/32
      - 13.89.179.14/32
      - 20.40.0.0/14
      - 20.48.0.0/12
      - 20.64.0.0/12
      - 52.123.0.0/16
      - 52.108.0.0/14
      - 52.136.0.0/13
      - 57.150.0.0/15
      - 80.239.150.67/32
      - 2620:1ec:4::192/128
      - 2620:1ec:a92::192/128
    DestinationPort: 443
    Protocol: tcp
  filter_main_destination_host:
    DestinationHostname|endswith: .deploy.static.akamaitechnologies.com
    DestinationPort: 443
    Protocol: tcp
  condition: selection and not 1 of filter_main_*
falsepositives:
  - You may have to tune certain domains out that Excel may call out to, such as microsoft or other business use case domains.
  - Office documents commonly have templates that refer to external addresses, like "sharepoint.ourcompany.com" may have to be tuned.
  - It is highly recommended to baseline your activity and tune out common business use cases.
level: medium
license: DRL-1.1
related:
  - id: 75e33ce3-ae32-4dcc-9aa8-a2a3029d6f84
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL