Sunturai
Back to results
MediumSigmaHQChristopher Peacock '@securepeacock' +4

Office Application Initiated Network Connection To Non-Local IP

Detects an office application (Word, Excel, PowerPoint) that initiate a network connection to a non-private IP addresses. This rule aims to detect traffic similar to one seen exploited in CVE-2021-42292. This rule…

Description

Detects an office application (Word, Excel, PowerPoint) that initiate a network connection to a non-private IP addresses. This rule aims to detect traffic similar to one seen exploited in CVE-2021-42292. This rule will require an initial baseline and tuning that is specific to your organization.

Detection logic

Detection requirements

Platform
LinuxmacOSWindows

The rule states no platform. This is derived from the ATT&CK technique it maps to.

Log source product
windows
Log source category
network_connection

Known benign triggers

  • It is highly recommended to baseline your activity and tune out common business use cases.
  • Office documents commonly have templates that refer to external addresses, like "sharepoint.ourcompany.com" may have to be tuned.
  • You may have to tune certain domains out that Excel may call out to, such as microsoft or other business use case domains.

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice