{"id":"75e33ce3-ae32-4dcc-9aa8-a2a3029d6f84","title":"Office Application Initiated Network Connection To Non-Local IP","description":"Detects an office application (Word, Excel, PowerPoint) that initiate a network connection to a non-private IP addresses.\nThis rule aims to detect traffic similar to one seen exploited in CVE-2021-42292.\nThis rule will require an initial baseline and tuning that is specific to your organization.\n","author":"Christopher Peacock '@securepeacock', SCYTHE '@scythe_io', Florian Roth (Nextron Systems), Tim Shelton, Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2021-11-10","modified":"2025-10-17","tags":["attack.execution","attack.t1203"],"technique_ids":["T1203"],"logsource":{"category":"network_connection","product":"windows"},"falsepositives":["You may have to tune certain domains out that Excel may call out to, such as microsoft or other business use case domains.","Office documents commonly have templates that refer to external addresses, like \"sharepoint.ourcompany.com\" may have to be tuned.","It is highly recommended to baseline your activity and tune out common business use cases."],"references":["https://corelight.com/blog/detecting-cve-2021-42292","https://learn.microsoft.com/de-de/microsoft-365/enterprise/urls-and-ip-address-ranges?view=o365-worldwide"],"source_path":"rules/windows/network_connection/net_connection_win_office_outbound_non_local_ip.yml","source_sha256":"d68cc47e3090ba9840363b03a45bc4faa5a9d01fe25b3abae60c7c0fa7d57738","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/network_connection/net_connection_win_office_outbound_non_local_ip.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Office Application Initiated Network Connection To Non-Local IP\nid: 75e33ce3-ae32-4dcc-9aa8-a2a3029d6f84\nstatus: test\ndescription: |\n Detects an office application (Word, Excel, PowerPoint) that initiate a network connection to a non-private IP addresses.\n This rule aims to detect traffic similar to one seen exploited in CVE-2021-42292.\n This rule will require an initial baseline and tuning that is specific to your organization.\nreferences:\n - https://corelight.com/blog/detecting-cve-2021-42292\n - https://learn.microsoft.com/de-de/microsoft-365/enterprise/urls-and-ip-address-ranges?view=o365-worldwide\nauthor: Christopher Peacock '@securepeacock', SCYTHE '@scythe_io', Florian Roth (Nextron Systems), Tim Shelton, Nasreddine Bencherchali (Nextron Systems)\ndate: 2021-11-10\nmodified: 2025-10-17\ntags:\n - attack.execution\n - attack.t1203\nlogsource:\n category: network_connection\n product: windows\ndetection:\n selection:\n Image|endswith:\n - '\\excel.exe'\n - '\\outlook.exe'\n - '\\powerpnt.exe'\n - '\\winword.exe'\n - '\\wordview.exe'\n Initiated: 'true'\n filter_main_local_ranges:\n DestinationIp|cidr:\n - '127.0.0.0/8'\n - '10.0.0.0/8'\n - '172.16.0.0/12'\n - '192.168.0.0/16'\n - '169.254.0.0/16'\n - '::1/128' # IPv6 loopback\n - 'fe80::/10' # IPv6 link-local addresses\n - 'fc00::/7' # IPv6 private addresses\n filter_main_msrange_generic:\n DestinationIp|cidr:\n - '2.16.56.0/23' # Akamai International B.V.\n - '2.17.248.0/21' # Akamai International B.V.\n - '13.107.240.0/21' # Microsoft Corporation\n - '20.184.0.0/13' # Microsoft Corporation\n - '23.61.224.0/20' # Akamai-AS\n - '20.192.0.0/10' # Microsoft Corporation\n - '23.72.0.0/13' # Akamai International B.V.\n - '23.3.88.0/22' # Akamai-AS\n - '23.216.132.0/22' # Akamai-AS\n - '40.76.0.0/14' # Microsoft Corporation\n - '51.10.0.0/15' # Microsoft Corporation\n - '51.103.0.0/16' # Microsoft Corporation\n - '51.104.0.0/15' # Microsoft Corporation\n - '51.142.136.0/22' # Microsoft Corporation - https://ipinfo.io/AS8075/51.140.0.0/14-51.142.136.0/22\n - '52.160.0.0/11' # Microsoft Corporation - https://ipinfo.io/AS8075/52.160.0.0/11\n - '95.101.96.0/21' # Akamai-As\n - '204.79.197.0/24' # Microsoft Corporation\n filter_main_msrange_exchange_1:\n # Exchange Online\n # \"urls\": [\n # \"outlook.cloud.microsoft\",\n # \"outlook.office.com\",\n # \"outlook.office365.com\"\n # ]\n DestinationIp|cidr:\n - '13.107.4.0/22'\n - '13.107.6.152/31'\n - '13.107.18.10/31'\n - '13.107.42.0/23'\n - '13.107.128.0/22'\n - '23.35.224.0/20'\n - '23.53.40.0/22'\n - '23.103.160.0/20'\n - '23.216.76.0/22'\n - '40.96.0.0/13'\n - '40.104.0.0/15'\n - '52.96.0.0/14'\n - '131.253.33.215/32'\n - '132.245.0.0/16'\n - '150.171.32.0/22'\n - '204.79.197.215/32'\n - '2603:1006::/40'\n - '2603:1016::/36'\n - '2603:1026::/36'\n - '2603:1036::/36'\n - '2603:1046::/36'\n - '2603:1056::/36'\n - '2620:1ec:4::152/128'\n - '2620:1ec:4::153/128'\n - '2620:1ec:c::10/128'\n - '2620:1ec:c::11/128'\n - '2620:1ec:d::10/128'\n - '2620:1ec:d::11/128'\n - '2620:1ec:8f0::/46'\n - '2620:1ec:900::/46'\n - '2620:1ec:a92::152/128'\n - '2620:1ec:a92::153/128'\n DestinationPort:\n - 80\n - 443\n filter_main_msrange_exchange_2:\n # Exchange Online\n # \"urls\": [\n # \"outlook.office365.com\",\n # \"smtp.office365.com\"\n # ]\n DestinationIp|cidr:\n - '13.107.6.152/31'\n - '13.107.18.10/31'\n - '13.107.128.0/22'\n - '23.103.160.0/20'\n - '40.96.0.0/13'\n - '40.104.0.0/15'\n - '52.96.0.0/14'\n - '131.253.33.215/32'\n - '132.245.0.0/16'\n - '150.171.32.0/22'\n - '204.79.197.215/32'\n - '2603:1006::/40'\n - '2603:1016::/36'\n - '2603:1026::/36'\n - '2603:1036::/36'\n - '2603:1046::/36'\n - '2603:1056::/36'\n - '2620:1ec:4::152/128'\n - '2620:1ec:4::153/128'\n - '2620:1ec:c::10/128'\n - '2620:1ec:c::11/128'\n - '2620:1ec:d::10/128'\n - '2620:1ec:d::11/128'\n - '2620:1ec:8f0::/46'\n - '2620:1ec:900::/46'\n - '2620:1ec:a92::152/128'\n - '2620:1ec:a92::153/128'\n DestinationPort:\n - 143\n - 587\n - 993\n - 995\n Protocol: 'tcp'\n filter_main_msrange_exchange_3:\n # Exchange Online\n # \"urls\": [\n # \"*.protection.outlook.com\"\n # ]\n DestinationIp|cidr:\n - '40.92.0.0/15'\n - '40.107.0.0/16'\n - '52.100.0.0/14'\n - '52.238.78.88/32'\n - '104.47.0.0/17'\n - '2a01:111:f400::/48'\n - '2a01:111:f403::/48'\n DestinationPort: 443\n filter_main_msrange_exchange_4:\n # Exchange Online\n # \"urls\": [\n # \"*.mail.protection.outlook.com\",\n # \"*.mx.microsoft\"\n # ]\n DestinationIp|cidr:\n - '40.92.0.0/15'\n - '40.107.0.0/16'\n - '52.100.0.0/14'\n - '52.238.78.88/32'\n - '104.47.0.0/17'\n - '2a01:111:f400::/48'\n - '2a01:111:f403::/48'\n DestinationPort: 25\n filter_main_msrange_sharepoint_1:\n # SharePoint Online and OneDrive for Business\",\n # \"urls\": [\n # \"*.sharepoint.com\"\n # ]\n DestinationIp|cidr:\n - '13.107.136.0/22'\n - '40.108.128.0/17'\n - '52.104.0.0/14'\n - '104.146.128.0/17'\n - '150.171.40.0/22'\n - '2603:1061:1300::/40'\n - '2620:1ec:8f8::/46'\n - '2620:1ec:908::/46'\n - '2a01:111:f402::/48'\n DestinationPort:\n - 80\n - 443\n Protocol: 'tcp'\n filter_main_msrange_office_1:\n # Microsoft 365 Common and Office Online\",\n # \"urls\": [\n # \"*.officeapps.live.com\",\n # \"*.online.office.com\",\n # \"office.live.com\",\n # \"office.com.akadns.net\"\n # ],\n DestinationIp|cidr:\n - '13.107.6.171/32'\n - '13.107.18.15/32'\n - '13.107.140.6/32'\n - '20.64.0.0/10'\n - '52.108.0.0/14'\n - '52.244.37.168/32'\n - '2603:1006:1400::/40'\n - '2603:1016:2400::/40'\n - '2603:1026:2400::/40'\n - '2603:1036:2400::/40'\n - '2603:1046:1400::/40'\n - '2603:1056:1400::/40'\n - '2603:1063:2000::/38'\n - '2620:1ec:c::15/128'\n - '2620:1ec:8fc::6/128'\n - '2620:1ec:a92::171/128'\n - '2a01:111:f100:2000::a83e:3019/128'\n - '2a01:111:f100:2002::8975:2d79/128'\n - '2a01:111:f100:2002::8975:2da8/128'\n - '2a01:111:f100:7000::6fdd:6cd5/128'\n - '2a01:111:f100:a004::bfeb:88cf/128'\n DestinationPort:\n - 80\n - 443\n Protocol: 'tcp'\n filter_main_msrange_office_2:\n # Microsoft 365 Common and Office Online\n # \"urls\": [\n # \"*.auth.microsoft.com\",\n # \"*.msftidentity.com\",\n # \"*.msidentity.com\",\n # \"account.activedirectory.windowsazure.com\",\n # \"accounts.accesscontrol.windows.net\",\n # \"adminwebservice.microsoftonline.com\",\n # \"api.passwordreset.microsoftonline.com\",\n # \"autologon.microsoftazuread-sso.com\",\n # \"becws.microsoftonline.com\",\n # \"ccs.login.microsoftonline.com\",\n # \"clientconfig.microsoftonline-p.net\",\n # \"cloudapp.azure.com\",\n # \"companymanager.microsoftonline.com\",\n # \"device.login.microsoftonline.com\",\n # \"graph.microsoft.com\",\n # \"graph.windows.net\",\n # \"login-us.microsoftonline.com\",\n # \"login.microsoft.com\",\n # \"login.microsoftonline-p.com\",\n # \"login.microsoftonline.com\",\n # \"login.windows.net\",\n # \"logincert.microsoftonline.com\",\n # \"loginex.microsoftonline.com\",\n # \"nexus.microsoftonline-p.com\",\n # \"passwordreset.microsoftonline.com\",\n # \"provisioningapi.microsoftonline.com\",\n # \"web.core.windows.net\",\n # ]\n DestinationIp|cidr:\n - '172.128.0.0/10'\n - '20.20.32.0/19'\n - '20.103.156.88/32' # msn.com\n - '20.190.128.0/18'\n - '20.231.128.0/19'\n - '40.126.0.0/18'\n - '57.150.0.0/15'\n - '2603:1006:2000::/48'\n - '2603:1007:200::/48'\n - '2603:1016:1400::/48'\n - '2603:1017::/48'\n - '2603:1026:3000::/48'\n - '2603:1027:1::/48'\n - '2603:1036:3000::/48'\n - '2603:1037:1::/48'\n - '2603:1046:2000::/48'\n - '2603:1047:1::/48'\n - '2603:1056:2000::/48'\n - '2603:1057:2::/48'\n DestinationPort:\n - 80\n - 443\n Protocol: 'tcp'\n filter_main_msrange_office_3:\n # Microsoft 365 Common and Office Online\n # \"urls\": [\n # \"*.compliance.microsoft.com\",\n # \"*.data.microsoft.com\",\n # \"*.protection.office.com\",\n # \"*.security.microsoft.com\",\n # \"compliance.microsoft.com\",\n # \"defender.microsoft.com\",\n # \"protection.office.com\",\n # \"security.microsoft.com\",\n # \"teams.microsoft.com\",\n # ]\n DestinationIp|cidr:\n - '13.64.0.0/11'\n - '13.107.6.192/32'\n - '13.107.9.192/32'\n - '13.89.179.14/32'\n - '20.40.0.0/14'\n - '20.48.0.0/12'\n - '20.64.0.0/12'\n - '52.123.0.0/16'\n - '52.108.0.0/14'\n - '52.136.0.0/13'\n - '57.150.0.0/15'\n - '80.239.150.67/32' # Arelion Sweden AB\n - '2620:1ec:4::192/128'\n - '2620:1ec:a92::192/128'\n DestinationPort: 443\n Protocol: 'tcp'\n filter_main_destination_host:\n DestinationHostname|endswith: '.deploy.static.akamaitechnologies.com'\n DestinationPort: 443\n Protocol: 'tcp'\n condition: selection and not 1 of filter_main_*\nfalsepositives:\n - You may have to tune certain domains out that Excel may call out to, such as microsoft or other business use case domains.\n - Office documents commonly have templates that refer to external addresses, like \"sharepoint.ourcompany.com\" may have to be tuned.\n - It is highly recommended to baseline your activity and tune out common business use cases.\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1203","id":"T1203","name":"Exploitation for Client Execution","page":"techniques/enterprise/T1203/"}],"data_path":"data/detection-rules/75e33ce3-ae32-4dcc-9aa8-a2a3029d6f84.json","kind":"sigma"}