Dfsvc.EXE Initiated Network Connection Over Uncommon Port

{
  "network_connection": {
    "EventID": 5156,
    "Channel": "Security"
  },
  "selection": {
    "Application
| contains": ":\\Windows\\Microsoft.NET\\",
    "Application
| endswith": "\\dfsvc.exe",
    "Direction": "%%14593"
  },
  "filter_main_known_ports": {
    "DestPort": [
      80,
      443
    ]
  },
  "filter_optional_dns_ipv6": {
    "DestinationIsIpv6": "true",
    "DestPort": 53
  },
  "condition": "network_connection and (selection and not 1 of filter_main_* and not 1 of filter_optional_*)"
}

False Positives

• ⚠ Unknown