Dfsvc.EXE Initiated Network Connection Over Uncommon Port

{
  "network_connection": {
    "EventID": 3,
    "Channel": "Microsoft-Windows-Sysmon/Operational"
  },
  "selection": {
    "Image
| contains": ":\\Windows\\Microsoft.NET\\",
    "Image
| endswith": "\\dfsvc.exe",
    "Initiated": "true"
  },
  "filter_main_known_ports": {
    "DestinationPort": [
      80,
      443
    ]
  },
  "filter_optional_dns_ipv6": {
    "DestinationIsIpv6": "true",
    "DestinationPort": 53
  },
  "condition": "network_connection and (selection and not 1 of filter_main_* and not 1 of filter_optional_*)"
}

False Positives

• ⚠ Unknown