Office Application Initiated Network Connection Over Uncommon Ports

SigmaHQ Detections@sigmaHQ

•updated Oct 17, 2025•0•12

Detects an office suite application (Word, Excel, PowerPoint, Outlook) communicating to target systems over uncommon ports. This rule specifically looks for network connections initiated by these applications, excluding common ports used for DNS, HTTP, HTTPS, SMB, LDAP, and specific Outlook-related ports (IMAP, POP3, SMTP).