detection.wiki

Detection rules › Sigma

Office Application Initiated Network Connection To Non-Local IP

Severity
medium
Author
Christopher Peacock '@securepeacock', SCYTHE '@scythe_io', Florian Roth (Nextron Systems), Tim Shelton, Nasreddine Bencherchali (Nextron Systems)
Source
upstream

Detects an office application (Word, Excel, PowerPoint) that initiate a network connection to a non-private IP addresses. This rule aims to detect traffic similar to one seen exploited in CVE-2021-42292. This rule will require an initial baseline and tuning that is specific to your organization.

MITRE ATT&CK coverage

TacticTechniques
ExecutionT1203 Exploitation for Client Execution

Event coverage

ProviderEvent IDTitle
Sysmon3Network connection

Stages and Predicates

Stage 1: selection

or:
Image|endswith: '\excel.exe'
Image|endswith: '\outlook.exe'
Image|endswith: '\powerpnt.exe'
Image|endswith: '\winword.exe'
Image|endswith: '\wordview.exe'
Initiated: true

Stage 2: not 1 of filter_main_*

or:
or:
DestinationIp|cidr: '104.146.128.0/17'
DestinationIp|cidr: '13.107.136.0/22'
DestinationIp|cidr: '150.171.40.0/22'
DestinationIp|cidr: '2603:1061:1300::/40'
DestinationIp|cidr: '2620:1ec:8f8::/46'
DestinationIp|cidr: '2620:1ec:908::/46'
DestinationIp|cidr: '2a01:111:f402::/48'
DestinationIp|cidr: '40.108.128.0/17'
DestinationIp|cidr: '52.104.0.0/14'
DestinationPort: [443, 80]
Protocol: tcp
or:
DestinationIp|cidr: '104.47.0.0/17'
DestinationIp|cidr: '2a01:111:f400::/48'
DestinationIp|cidr: '2a01:111:f403::/48'
DestinationIp|cidr: '40.107.0.0/16'
DestinationIp|cidr: '40.92.0.0/15'
DestinationIp|cidr: '52.100.0.0/14'
DestinationIp|cidr: '52.238.78.88/32'
DestinationPort: 25
or:
DestinationIp|cidr: '104.47.0.0/17'
DestinationIp|cidr: '2a01:111:f400::/48'
DestinationIp|cidr: '2a01:111:f403::/48'
DestinationIp|cidr: '40.107.0.0/16'
DestinationIp|cidr: '40.92.0.0/15'
DestinationIp|cidr: '52.100.0.0/14'
DestinationIp|cidr: '52.238.78.88/32'
DestinationPort: 443
or:
DestinationIp|cidr: '13.107.128.0/22'
DestinationIp|cidr: '13.107.18.10/31'
DestinationIp|cidr: '13.107.4.0/22'
DestinationIp|cidr: '13.107.42.0/23'
DestinationIp|cidr: '13.107.6.152/31'
DestinationIp|cidr: '131.253.33.215/32'
DestinationIp|cidr: '132.245.0.0/16'
DestinationIp|cidr: '150.171.32.0/22'
DestinationIp|cidr: '204.79.197.215/32'
DestinationIp|cidr: '23.103.160.0/20'
DestinationIp|cidr: '23.216.76.0/22'
DestinationIp|cidr: '23.35.224.0/20'
DestinationIp|cidr: '23.53.40.0/22'
DestinationIp|cidr: '2603:1006::/40'
DestinationIp|cidr: '2603:1016::/36'
DestinationIp|cidr: '2603:1026::/36'
DestinationIp|cidr: '2603:1036::/36'
DestinationIp|cidr: '2603:1046::/36'
DestinationIp|cidr: '2603:1056::/36'
DestinationIp|cidr: '2620:1ec:4::152/128'
DestinationIp|cidr: '2620:1ec:4::153/128'
DestinationIp|cidr: '2620:1ec:8f0::/46'
DestinationIp|cidr: '2620:1ec:900::/46'
DestinationIp|cidr: '2620:1ec:a92::152/128'
DestinationIp|cidr: '2620:1ec:a92::153/128'
DestinationIp|cidr: '2620:1ec:c::10/128'
DestinationIp|cidr: '2620:1ec:c::11/128'
DestinationIp|cidr: '2620:1ec:d::10/128'
DestinationIp|cidr: '2620:1ec:d::11/128'
DestinationIp|cidr: '40.104.0.0/15'
DestinationIp|cidr: '40.96.0.0/13'
DestinationIp|cidr: '52.96.0.0/14'
DestinationPort: [443, 80]
or:
DestinationIp|cidr: '13.107.128.0/22'
DestinationIp|cidr: '13.107.18.10/31'
DestinationIp|cidr: '13.107.6.152/31'
DestinationIp|cidr: '131.253.33.215/32'
DestinationIp|cidr: '132.245.0.0/16'
DestinationIp|cidr: '150.171.32.0/22'
DestinationIp|cidr: '204.79.197.215/32'
DestinationIp|cidr: '23.103.160.0/20'
DestinationIp|cidr: '2603:1006::/40'
DestinationIp|cidr: '2603:1016::/36'
DestinationIp|cidr: '2603:1026::/36'
DestinationIp|cidr: '2603:1036::/36'
DestinationIp|cidr: '2603:1046::/36'
DestinationIp|cidr: '2603:1056::/36'
DestinationIp|cidr: '2620:1ec:4::152/128'
DestinationIp|cidr: '2620:1ec:4::153/128'
DestinationIp|cidr: '2620:1ec:8f0::/46'
DestinationIp|cidr: '2620:1ec:900::/46'
DestinationIp|cidr: '2620:1ec:a92::152/128'
DestinationIp|cidr: '2620:1ec:a92::153/128'
DestinationIp|cidr: '2620:1ec:c::10/128'
DestinationIp|cidr: '2620:1ec:c::11/128'
DestinationIp|cidr: '2620:1ec:d::10/128'
DestinationIp|cidr: '2620:1ec:d::11/128'
DestinationIp|cidr: '40.104.0.0/15'
DestinationIp|cidr: '40.96.0.0/13'
DestinationIp|cidr: '52.96.0.0/14'
DestinationPort: [143, 587, 993, 995]
Protocol: tcp
or:
DestinationIp|cidr: '13.107.140.6/32'
DestinationIp|cidr: '13.107.18.15/32'
DestinationIp|cidr: '13.107.6.171/32'
DestinationIp|cidr: '20.64.0.0/10'
DestinationIp|cidr: '2603:1006:1400::/40'
DestinationIp|cidr: '2603:1016:2400::/40'
DestinationIp|cidr: '2603:1026:2400::/40'
DestinationIp|cidr: '2603:1036:2400::/40'
DestinationIp|cidr: '2603:1046:1400::/40'
DestinationIp|cidr: '2603:1056:1400::/40'
DestinationIp|cidr: '2603:1063:2000::/38'
DestinationIp|cidr: '2620:1ec:8fc::6/128'
DestinationIp|cidr: '2620:1ec:a92::171/128'
DestinationIp|cidr: '2620:1ec:c::15/128'
DestinationIp|cidr: '2a01:111:f100:2000::a83e:3019/128'
DestinationIp|cidr: '2a01:111:f100:2002::8975:2d79/128'
DestinationIp|cidr: '2a01:111:f100:2002::8975:2da8/128'
DestinationIp|cidr: '2a01:111:f100:7000::6fdd:6cd5/128'
DestinationIp|cidr: '2a01:111:f100:a004::bfeb:88cf/128'
DestinationIp|cidr: '52.108.0.0/14'
DestinationIp|cidr: '52.244.37.168/32'
DestinationPort: [443, 80]
Protocol: tcp
or:
DestinationIp|cidr: '13.107.6.192/32'
DestinationIp|cidr: '13.107.9.192/32'
DestinationIp|cidr: '13.64.0.0/11'
DestinationIp|cidr: '13.89.179.14/32'
DestinationIp|cidr: '20.40.0.0/14'
DestinationIp|cidr: '20.48.0.0/12'
DestinationIp|cidr: '20.64.0.0/12'
DestinationIp|cidr: '2620:1ec:4::192/128'
DestinationIp|cidr: '2620:1ec:a92::192/128'
DestinationIp|cidr: '52.108.0.0/14'
DestinationIp|cidr: '52.123.0.0/16'
DestinationIp|cidr: '52.136.0.0/13'
DestinationIp|cidr: '57.150.0.0/15'
DestinationIp|cidr: '80.239.150.67/32'
DestinationPort: 443
Protocol: tcp
or:
DestinationIp|cidr: '172.128.0.0/10'
DestinationIp|cidr: '20.103.156.88/32'
DestinationIp|cidr: '20.190.128.0/18'
DestinationIp|cidr: '20.20.32.0/19'
DestinationIp|cidr: '20.231.128.0/19'
DestinationIp|cidr: '2603:1006:2000::/48'
DestinationIp|cidr: '2603:1007:200::/48'
DestinationIp|cidr: '2603:1016:1400::/48'
DestinationIp|cidr: '2603:1017::/48'
DestinationIp|cidr: '2603:1026:3000::/48'
DestinationIp|cidr: '2603:1027:1::/48'
DestinationIp|cidr: '2603:1036:3000::/48'
DestinationIp|cidr: '2603:1037:1::/48'
DestinationIp|cidr: '2603:1046:2000::/48'
DestinationIp|cidr: '2603:1047:1::/48'
DestinationIp|cidr: '2603:1056:2000::/48'
DestinationIp|cidr: '2603:1057:2::/48'
DestinationIp|cidr: '40.126.0.0/18'
DestinationIp|cidr: '57.150.0.0/15'
DestinationPort: [443, 80]
Protocol: tcp
DestinationHostname|endswith: '.deploy.static.akamaitechnologies.com'
DestinationPort: 443
Protocol: tcp
DestinationIp|cidr: '10.0.0.0/8'
DestinationIp|cidr: '127.0.0.0/8'
DestinationIp|cidr: '13.107.240.0/21'
DestinationIp|cidr: '169.254.0.0/16'
DestinationIp|cidr: '172.16.0.0/12'
DestinationIp|cidr: '192.168.0.0/16'
DestinationIp|cidr: '2.16.56.0/23'
DestinationIp|cidr: '2.17.248.0/21'
DestinationIp|cidr: '20.184.0.0/13'
DestinationIp|cidr: '20.192.0.0/10'
DestinationIp|cidr: '204.79.197.0/24'
DestinationIp|cidr: '23.216.132.0/22'
DestinationIp|cidr: '23.3.88.0/22'
DestinationIp|cidr: '23.61.224.0/20'
DestinationIp|cidr: '23.72.0.0/13'
DestinationIp|cidr: '40.76.0.0/14'
DestinationIp|cidr: '51.10.0.0/15'
DestinationIp|cidr: '51.103.0.0/16'
DestinationIp|cidr: '51.104.0.0/15'
DestinationIp|cidr: '51.142.136.0/22'
DestinationIp|cidr: '52.160.0.0/11'
DestinationIp|cidr: '95.101.96.0/21'
DestinationIp|cidr: '::1/128'
DestinationIp|cidr: 'fc00::/7'
DestinationIp|cidr: 'fe80::/10'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
DestinationHostnameends_with
  • .deploy.static.akamaitechnologies.com
DestinationIpcidr_match
  • 10.0.0.0/8 corpus 12 (sigma 12)
  • 104.146.128.0/17
  • 104.47.0.0/17
  • 127.0.0.0/8 corpus 13 (sigma 13)
  • 13.107.128.0/22
  • 13.107.136.0/22
  • 13.107.140.6/32
  • 13.107.18.10/31
  • 13.107.18.15/32
  • 13.107.240.0/21
  • 13.107.4.0/22
  • 13.107.42.0/23
  • 13.107.6.152/31
  • 13.107.6.171/32
  • 13.107.6.192/32
  • 13.107.9.192/32
  • 13.64.0.0/11
  • 13.89.179.14/32
  • 131.253.33.215/32
  • 132.245.0.0/16
  • 150.171.32.0/22
  • 150.171.40.0/22
  • 169.254.0.0/16 corpus 12 (sigma 12)
  • 172.128.0.0/10
  • 172.16.0.0/12 corpus 12 (sigma 12)
  • 192.168.0.0/16 corpus 12 (sigma 12)
  • 2.16.56.0/23
  • 2.17.248.0/21
  • 20.103.156.88/32
  • 20.184.0.0/13 corpus 2 (sigma 2)
  • 20.190.128.0/18
  • 20.192.0.0/10 corpus 2 (sigma 2)
  • 20.20.32.0/19
  • 20.231.128.0/19
  • 20.40.0.0/14
  • 20.48.0.0/12
  • 20.64.0.0/10
  • 20.64.0.0/12
  • 204.79.197.0/24
  • 204.79.197.215/32
  • 23.103.160.0/20
  • 23.216.132.0/22
  • 23.216.76.0/22
  • 23.3.88.0/22
  • 23.35.224.0/20
  • 23.53.40.0/22
  • 23.61.224.0/20
  • 23.72.0.0/13
  • 2603:1006:1400::/40
  • 2603:1006:2000::/48
  • 2603:1006::/40
  • 2603:1007:200::/48
  • 2603:1016:1400::/48
  • 2603:1016:2400::/40
  • 2603:1016::/36
  • 2603:1017::/48
  • 2603:1026:2400::/40
  • 2603:1026:3000::/48
  • 2603:1026::/36
  • 2603:1027:1::/48
  • 2603:1036:2400::/40
  • 2603:1036:3000::/48
  • 2603:1036::/36
  • 2603:1037:1::/48
  • 2603:1046:1400::/40
  • 2603:1046:2000::/48
  • 2603:1046::/36
  • 2603:1047:1::/48
  • 2603:1056:1400::/40
  • 2603:1056:2000::/48
  • 2603:1056::/36
  • 2603:1057:2::/48
  • 2603:1061:1300::/40
  • 2603:1063:2000::/38
  • 2620:1ec:4::152/128
  • 2620:1ec:4::153/128
  • 2620:1ec:4::192/128
  • 2620:1ec:8f0::/46
  • 2620:1ec:8f8::/46
  • 2620:1ec:8fc::6/128
  • 2620:1ec:900::/46
  • 2620:1ec:908::/46
  • 2620:1ec:a92::152/128
  • 2620:1ec:a92::153/128
  • 2620:1ec:a92::171/128
  • 2620:1ec:a92::192/128
  • 2620:1ec:c::10/128
  • 2620:1ec:c::11/128
  • 2620:1ec:c::15/128
  • 2620:1ec:d::10/128
  • 2620:1ec:d::11/128
  • 2a01:111:f100:2000::a83e:3019/128
  • 2a01:111:f100:2002::8975:2d79/128
  • 2a01:111:f100:2002::8975:2da8/128
  • 2a01:111:f100:7000::6fdd:6cd5/128
  • 2a01:111:f100:a004::bfeb:88cf/128
  • 2a01:111:f400::/48
  • 2a01:111:f402::/48
  • 2a01:111:f403::/48
  • 40.104.0.0/15
  • 40.107.0.0/16
  • 40.108.128.0/17
  • 40.126.0.0/18
  • 40.76.0.0/14
  • 40.92.0.0/15
  • 40.96.0.0/13
  • 51.10.0.0/15 corpus 2 (sigma 2)
  • 51.103.0.0/16 corpus 3 (sigma 3)
  • 51.104.0.0/15 corpus 2 (sigma 2)
  • 51.142.136.0/22
  • 52.100.0.0/14
  • 52.104.0.0/14
  • 52.108.0.0/14
  • 52.123.0.0/16
  • 52.136.0.0/13
  • 52.160.0.0/11
  • 52.238.78.88/32
  • 52.244.37.168/32
  • 52.96.0.0/14
  • 57.150.0.0/15
  • 80.239.150.67/32
  • 95.101.96.0/21
  • ::1/128 corpus 13 (sigma 13)
  • fc00::/7 corpus 12 (sigma 12)
  • fe80::/10 corpus 12 (sigma 12)
DestinationPorteq
  • 143 corpus 2 (sigma 2)
  • 25 corpus 2 (sigma 2)
  • 443 corpus 7 (sigma 7)
  • 587 corpus 4 (sigma 4)
  • 80 corpus 6 (sigma 6)
  • 993 corpus 3 (sigma 3)
  • 995 corpus 3 (sigma 3)
Imageends_with
  • \excel.exe corpus 16 (sigma 16)
  • \outlook.exe corpus 16 (sigma 16)
  • \powerpnt.exe corpus 13 (sigma 13)
  • \winword.exe corpus 17 (sigma 17)
  • \wordview.exe corpus 6 (sigma 6)
Initiatedeq
  • true corpus 40 (sigma 40)
Protocoleq
  • tcp