Query: rule covering Detects an office application (Word, Excel, PowerPoint) that initiate a network connection to a non-private IP addresse
Matching passage: Sigma rule: Detects an office application (Word, Excel, PowerPoint) that initiate a network connection to a non-private IP addresse. Logsource: windows / network_connection. Rule: title: Office Application Initiated Network Connection To Non-Local IP id: 75e33ce3-ae32-4dcc-9aa8-a2a3029d6f84 status: test description: 'Detects an office application (Word, Excel, PowerPoint) that initiate a network connection to a non-private IP addresses. This rule aims to detect traffic similar to one seen exploited in CVE-2021-42292. This rule will require an initial baseline and tuning that is specific to your organization. ' references: - https://corelight.com/blog/detecting-cve-2021-42292 - https://learn.microsoft.com/de-de/microsoft-365/enterprise/urls-and-ip-address-ranges?view=o365-worldwide author: Christopher Peacock '@securepeacock', SCYTHE '@scythe_io', Florian Roth (Nextron Systems), Tim Shelton, Nasreddine Bencherchali (Nextron Systems) date: 2021-11-10 modified: 2025-10-17 tags: - attack.execution - attack.t1203 logsource: category: network_connection product: windows detection: selection: Image|endswith: - \excel.exe - \outlook.exe - \powerpnt.exe - \winword.exe - \wordview.exe Initiated: 'true' filter_main_local_ranges: DestinationIp|cidr: - 127.0.0.0/8 - 10.0.0.0/8 - 172.16.0.0/12 - 192.168.0.0/16 - 169.254.0.0/16 - ::1/128 - fe80::/10 - fc00::/7 filter_main_msrange_generic: DestinationIp|cidr: - 2.16.56.0/23 - 2.17.248.0/21 - 13.107.240.0/21 - 20.184.0.0/13 - 23.61.224.0/20 - 20.192.0.0/10 - 23.72.0.0/13 - 23.3.88.0/22 - 23.216.132.0/22 - 40.76.0.0/14 - 51.10.0.0/15 - 51.103.0.0/16 - 51.104.0.0/15 - 51.142.136.0/22 - 52.160.0.0/11 - 95.101.96.0/21 - 204.79.197.0/24 filter_main_msrange_exchange_1: DestinationIp|cidr: - 13.107.4.0/22 - 13.107.6.152/31 - 13.107.18.10/31 - 13.107.42.0/23 - 13.107.128.0/22 - 23.35.224.0/20 - 23.53.40.0/22 - 23.103.160.0/20 - 23.216.76.0/22 - 40.96.0.0/13 - 40.104.0.0/15 - 52.96.0.0/14 - 131.253.33.215/32 - 132.245.0.0/16 - 150.171.32.0/22 - 204.79.197.215/32 - 2603:1006::/40 - 2603:1016::/36 - 2603:1026::/36 - 2603:1036::/36 - 2603:1046::/36 - 2603:1056::/36 - 2620:1ec:4::152/128 - 2620:1ec:4::153/128 - 2620:1ec:c::10/128 - 2620:1ec:c::11/128 - 2620:1ec:d::10/128 - 2620:1ec:d::11/128 - 2620:1ec:8f0::/46 - 2620:1ec:900::/46 - 2620:1ec:a92::152/128 - 2620:1ec:a92::153/128 DestinationPort: - 80 - 443 filter_main_msrange_exchange_2: DestinationIp|cidr: - 13.107.6.152/31 - 13.107.18.10/31 - 13.107.128.0/22 - 23.103.160.0/20 - 40.96.0.0/13 - 40.104.0.0/15 - 52.96.0.0/14 - 131.253.33.215/32 - 132.245.0.0/16 - 150.171.32.0/22 - 204.79.197.215/32 - 2603:1006::/40 - 2603:1016::/36 - 2603:1026::/36 - 2603:1036::/36
Near-miss passage: Sigma rule: Detects remote RPC calls to possibly abuse remote encryption service via MS-EFSR. Logsource: rpc_firewall / application. Rule: title: Remote Encrypting File System Abuse id: 5f92fff9-82e2-48eb-8fc1-8b133556a551 status: test description: Detects remote RPC calls to possibly abuse remote encryption service via MS-EFSR references: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-36942 - https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-EFSR.md - https://github.com/zeronetworks/rpcfirewall - https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/ author: Sagie Dulce, Dekel Paz date: 2022-01-01 tags: - attack.lateral-movement logsource: product: rpc_firewall category: application definition: 'Requirements: install and apply the RPC Firewall to all processes with "audit:true action:block uuid:df1941c5-fe89-4e79-bf10-463657acf44d or c681d488-d850-11d0-8c52-00c04fd90f7e' detection: selection: EventLog: RPCFW EventID: 3 InterfaceUuid: - df1941c5-fe89-4e79-bf10-463657acf44d - c681d488-d850-11d0-8c52-00c04fd90f7e condition: selection falsepositives: - Legitimate usage of remote file encryption level: high