Office Application Initiated Network Connection To Non-Local IP

SigmaHQ Detections@sigmaHQ

•updated Oct 17, 2025•5•1•50

Detects when a Microsoft Office application (Word, Excel, PowerPoint, Outlook, WordView) initiates an outbound network connection to an IP address that is not a private IP range or a known Microsoft/Akamai IP range. This rule aims to identify suspicious network activity from Office applications, potentially indicative of malware or exploitation, similar to behavior seen in CVE-2021-42292. Initial baselining and tuning are required to adapt to specific organizational environments.