Query: detect Detects an office application (Word, Excel, PowerPoint) that initiate a network connection to a non-private IP addresse in logs
Matching passage: Sigma rule: Detects an office application (Word, Excel, PowerPoint) that initiate a network connection to a non-private IP addresse. Logsource: windows / network_connection. Rule: title: Office Application Initiated Network Connection To Non-Local IP id: 75e33ce3-ae32-4dcc-9aa8-a2a3029d6f84 status: test description: 'Detects an office application (Word, Excel, PowerPoint) that initiate a network connection to a non-private IP addresses. This rule aims to detect traffic similar to one seen exploited in CVE-2021-42292. This rule will require an initial baseline and tuning that is specific to your organization. ' references: - https://corelight.com/blog/detecting-cve-2021-42292 - https://learn.microsoft.com/de-de/microsoft-365/enterprise/urls-and-ip-address-ranges?view=o365-worldwide author: Christopher Peacock '@securepeacock', SCYTHE '@scythe_io', Florian Roth (Nextron Systems), Tim Shelton, Nasreddine Bencherchali (Nextron Systems) date: 2021-11-10 modified: 2025-10-17 tags: - attack.execution - attack.t1203 logsource: category: network_connection product: windows detection: selection: Image|endswith: - \excel.exe - \outlook.exe - \powerpnt.exe - \winword.exe - \wordview.exe Initiated: 'true' filter_main_local_ranges: DestinationIp|cidr: - 127.0.0.0/8 - 10.0.0.0/8 - 172.16.0.0/12 - 192.168.0.0/16 - 169.254.0.0/16 - ::1/128 - fe80::/10 - fc00::/7 filter_main_msrange_generic: DestinationIp|cidr: - 2.16.56.0/23 - 2.17.248.0/21 - 13.107.240.0/21 - 20.184.0.0/13 - 23.61.224.0/20 - 20.192.0.0/10 - 23.72.0.0/13 - 23.3.88.0/22 - 23.216.132.0/22 - 40.76.0.0/14 - 51.10.0.0/15 - 51.103.0.0/16 - 51.104.0.0/15 - 51.142.136.0/22 - 52.160.0.0/11 - 95.101.96.0/21 - 204.79.197.0/24 filter_main_msrange_exchange_1: DestinationIp|cidr: - 13.107.4.0/22 - 13.107.6.152/31 - 13.107.18.10/31 - 13.107.42.0/23 - 13.107.128.0/22 - 23.35.224.0/20 - 23.53.40.0/22 - 23.103.160.0/20 - 23.216.76.0/22 - 40.96.0.0/13 - 40.104.0.0/15 - 52.96.0.0/14 - 131.253.33.215/32 - 132.245.0.0/16 - 150.171.32.0/22 - 204.79.197.215/32 - 2603:1006::/40 - 2603:1016::/36 - 2603:1026::/36 - 2603:1036::/36 - 2603:1046::/36 - 2603:1056::/36 - 2620:1ec:4::152/128 - 2620:1ec:4::153/128 - 2620:1ec:c::10/128 - 2620:1ec:c::11/128 - 2620:1ec:d::10/128 - 2620:1ec:d::11/128 - 2620:1ec:8f0::/46 - 2620:1ec:900::/46 - 2620:1ec:a92::152/128 - 2620:1ec:a92::153/128 DestinationPort: - 80 - 443 filter_main_msrange_exchange_2: DestinationIp|cidr: - 13.107.6.152/31 - 13.107.18.10/31 - 13.107.128.0/22 - 23.103.160.0/20 - 40.96.0.0/13 - 40.104.0.0/15 - 52.96.0.0/14 - 131.253.33.215/32 - 132.245.0.0/16 - 150.171.32.0/22 - 204.79.197.215/32 - 2603:1006::/40 - 2603:1016::/36 - 2603:1026::/36 - 2603:1036::/36
Near-miss passage: Sigma rule: Detects the execution of "Wlrmdr.exe" with the "-u" command line flag which allows anything passed to it to be an argume. Logsource: windows / process_creation. Rule: title: Wlrmdr.EXE Uncommon Argument Or Child Process id: 9cfc00b6-bfb7-49ce-9781-ef78503154bb status: experimental description: 'Detects the execution of "Wlrmdr.exe" with the "-u" command line flag which allows anything passed to it to be an argument of the ShellExecute API, which would allow an attacker to execute arbitrary binaries. This detection also focuses on any uncommon child processes spawned from "Wlrmdr.exe" as a supplement for those that posses "ParentImage" telemetry. ' references: - https://twitter.com/0gtweet/status/1493963591745220608?s=20&t=xUg9DsZhJy1q9bPTUWgeIQ - https://lolbas-project.github.io/lolbas/Binaries/Wlrmdr/ author: frack113, manasmbellani date: 2022-02-16 modified: 2025-10-31 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection_parent: ParentImage|endswith: \wlrmdr.exe selection_child_img: - Image|endswith: \wlrmdr.exe - OriginalFileName: WLRMNDR.EXE selection_child_cli_flags_s: CommandLine|contains|windash: '-s ' selection_child_cli_flags_f: CommandLine|contains|windash: '-f ' selection_child_cli_flags_t: CommandLine|contains|windash: '-t ' selection_child_cli_flags_m: CommandLine|contains|windash: '-m ' selection_child_cli_flags_a: CommandLine|contains|windash: '-a ' selection_child_cli_flags_u: CommandLine|contains|windash: '-u ' filter_main_winlogon: ParentImage: C:\Windows\System32\winlogon.exe filter_main_empty: ParentImage: - '' - '-' filter_main_null: ParentImage: null condition: selection_parent or (all of selection_child_* and not 1 of filter_main_*) falsepositives: - Unknown level: medium