Detectionmediumtest
Office Application Initiated Network Connection Over Uncommon Ports
Detects an office suit application (Word, Excel, PowerPoint, Outlook) communicating to target systems over uncommon ports.
Convert In Phoenix Studio
Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.
Launch
X__Junior (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)Created Wed Jul 12Updated Fri Oct 173b5ba899-9842-4bc2-acc2-12308498bf42windows
Log Source
WindowsNetwork Connection
ProductWindows← raw: windows
CategoryNetwork Connection← raw: network_connection
Events for outbound and inbound network connections including DNS resolution.
Detection Logic
Detection Logic3 selectors
detection:
selection:
Initiated: 'true'
Image|endswith:
- '\excel.exe'
- '\outlook.exe'
- '\powerpnt.exe'
- '\winword.exe'
- '\wordview.exe'
filter_main_common_ports:
DestinationPort:
- 53 # DNS
- 80 # HTTP
- 139 # NETBIOS
- 389 # LDAP
- 443 # HTTPS
- 445 # SMB
- 3268 # MSFT-GC
filter_main_outlook_ports:
Image|contains: ':\Program Files\Microsoft Office\'
Image|endswith: '\OUTLOOK.EXE'
DestinationPort:
- 143
- 465 # SMTP
- 587 # SMTP
- 993 # IMAP
- 995 # POP3
condition: selection and not 1 of filter_main_*False Positives
Other ports can be used, apply additional filters accordingly
References
MITRE ATT&CK
Rule Metadata
Rule ID
3b5ba899-9842-4bc2-acc2-12308498bf42
Status
test
Level
medium
Type
Detection
Created
Wed Jul 12
Modified
Fri Oct 17
Path
rules/windows/network_connection/net_connection_win_office_uncommon_ports.yml
Raw Tags
attack.defense-evasionattack.command-and-control