Helpers netconn_count:[1 TO *] (ipport:80 OR ipport:443) ipaddr:10.0.0.0/8 ipaddr:192.168.0.0/16 ipaddr:172.16.0.0/12 (process_name:winword.exe OR process_name:excel.exe OR process_name:powerpnt.exe) observed_filename:c:\windows\temp\