Office Application Initiated Network Connection Over Uncommon Ports

{
  "network_connection": {
    "EventID": 5156,
    "Channel": "Security"
  },
  "selection": {
    "Direction": "%%14593",
    "Application
| endswith": [
      "\\excel.exe",
      "\\outlook.exe",
      "\\powerpnt.exe",
      "\\winword.exe",
      "\\wordview.exe"
    ]
  },
  "filter_main_common_ports": {
    "DestPort": [
      53,
      80,
      139,
      389,
      443,
      445,
      3268
    ]
  },
  "filter_main_outlook_ports": {
    "Application
| contains": ":\\Program Files\\Microsoft Office\\",
    "Application
| endswith": "\\OUTLOOK.EXE",
    "DestPort": [
      143,
      465,
      587,
      993,
      995
    ]
  },
  "condition": "network_connection and (selection and not 1 of filter_main_*)"
}

False Positives

• ⚠ Other ports can be used, apply additional filters accordingly