Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2 detections
Filters
Last updated
All Time
Detection languages
2
Contributors
2
Categories
2
Platforms
2
Products / Services
1
1
MITRE Techniques
2
2
CVEs
71
71
64
58
49
Detects when a Microsoft Office application (Word, Excel, PowerPoint, Outlook, WordView) initiates an outbound network connection to an IP address that is not a private IP range or a known Microsoft/Akamai IP range. This rule aims to identify suspicious network activity from Office applications, potentially indicative of malware or exploitation, similar to behavior seen in CVE-2021-42292. Initial baselining and tuning are required to adapt to specific organizational environments.
Detects an office application (Word, Excel, PowerPoint) that initiate a network connection to a non-private IP addresses.
This rule aims to detect traffic similar to one seen exploited in CVE-2021-42292.
This rule will require an initial baseline and tuning that is specific to your organization.
This rule aims to detect traffic similar to one seen exploited in CVE-2021-42292.
This rule will require an initial baseline and tuning that is specific to your organization.