title: Excel Network Connections
id: 75e33ce3-ae32-4dcc-9aa8-a2a3029d6f84
status: experimental
description: Detects an Excel process that opens suspicious network connections to non-private IP addresses, and attempts to cover CVE-2021-42292. You will likely have to tune this rule for your organization, but it is certainly something you should look for and could have applications for malicious activity beyond CVE-2021-42292.
author: Christopher Peacock '@securepeacock', SCYTHE '@scythe_io', Florian Roth '@Neo23x0"
date: 2021/11/10
references:
    - https://corelight.com/blog/detecting-cve-2021-42292
tags:
    - attack.execution
    - attack.t1203
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        Image|endswith: '\excel.exe'
        Initiated: 'true'
        DestinationIsIpv6: 'false'
    filter:
        DestinationIp|startswith:
            - '10.'
            - '192.168.'
            - '172.16.'
            - '172.17.'
            - '172.18.'
            - '172.19.'
            - '172.20.'
            - '172.21.'
            - '172.22.'
            - '172.23.'
            - '172.24.'
            - '172.25.'
            - '172.26.'
            - '172.27.'
            - '172.28.'
            - '172.29.'
            - '172.30.'
            - '172.31.'
            - '127.0.0.1'
        DestinationIsIpv6: 'false'
    condition: selection and not filter
falsepositives:
    - You may have to tune certain domains out that Excel may call out to, such as microsoft or other business use case domains.
    - Office documents commonly have templates that refer to external addresses, like sharepoint.ourcompany.com may have to be tuned.
    - It is highly recomended to baseline your activity and tune out common business use cases.
level: medium
