Office Application Making Unusual Outbound Connection

Mehulkumar Savajani@Msavajani

•updated Jan 29, 2026•63•6•606

Detects Microsoft Office applications establishing outbound network connections to non-private, non-Microsoft IP addresses. This behavior can be indicative of exploitation of vulnerabilities like CVE-2026-21509, where an embedded OLE object or malicious macro attempts to download a payload or beacon out.