
title: Excel Network Connections
author: Christopher Peacock '@securepeacock', SCYTHE '@scythe_io', Florian Roth '@Neo23x0"
date: 2021/11/10
description: Detects an Excel process that opens suspicious network connections to
  non-private IP addresses, and attempts to cover CVE-2021-42292. You will likely
  have to tune this rule for your organization, but it is certainly something you
  should look for and could have applications for malicious activity beyond CVE-2021-42292.
detection:
  SELECTION_1:
    EventID: 3
  SELECTION_2:
    Image: '*\excel.exe'
  SELECTION_3:
    Initiated: 'true'
  SELECTION_4:
    DestinationIsIpv6: 'false'
  SELECTION_5:
    DestinationIp:
    - 10.*
    - 192.168.*
    - 172.16.*
    - 172.17.*
    - 172.18.*
    - 172.19.*
    - 172.20.*
    - 172.21.*
    - 172.22.*
    - 172.23.*
    - 172.24.*
    - 172.25.*
    - 172.26.*
    - 172.27.*
    - 172.28.*
    - 172.29.*
    - 172.30.*
    - 172.31.*
    - 127.0.0.1*
  SELECTION_6:
    DestinationIsIpv6: 'false'
  condition: (SELECTION_1 and (SELECTION_2 and SELECTION_3 and SELECTION_4) and  not
    (SELECTION_5 and SELECTION_6))
falsepositives:
- You may have to tune certain domains out that Excel may call out to, such as microsoft
  or other business use case domains.
- Office documents commonly have templates that refer to external addresses, like
  sharepoint.ourcompany.com may have to be tuned.
- It is highly recomended to baseline your activity and tune out common business use
  cases.
id: 75e33ce3-ae32-4dcc-9aa8-a2a3029d6f84
level: medium
logsource:
  category: network_connection
  product: windows
references:
- https://corelight.com/blog/detecting-cve-2021-42292
status: experimental
tags:
- attack.execution
- attack.t1203
ruletype: SIGMA
