Office Application Initiated Network Connection Over Uncommon Ports

{
  "network_connection": {
    "EventID": 3,
    "Channel": "Microsoft-Windows-Sysmon/Operational"
  },
  "selection": {
    "Initiated": "true",
    "Image
| endswith": [
      "\\excel.exe",
      "\\outlook.exe",
      "\\powerpnt.exe",
      "\\winword.exe",
      "\\wordview.exe"
    ]
  },
  "filter_main_common_ports": {
    "DestinationPort": [
      53,
      80,
      139,
      389,
      443,
      445,
      3268
    ]
  },
  "filter_main_outlook_ports": {
    "Image
| contains": ":\\Program Files\\Microsoft Office\\",
    "Image
| endswith": "\\OUTLOOK.EXE",
    "DestinationPort": [
      143,
      465,
      587,
      993,
      995
    ]
  },
  "condition": "network_connection and (selection and not 1 of filter_main_*)"
}

False Positives

• ⚠ Other ports can be used, apply additional filters accordingly