Dfsvc.EXE Network Connection To Non-Local IPs

{
  "network_connection": {
    "EventID": 5156,
    "Channel": "Security"
  },
  "selection": {
    "Application
| endswith": "\\dfsvc.exe",
    "Direction": "%%14593"
  },
  "filter_main_local_ip": {
    "DestAddress
| cidr": [
      "127.0.0.0/8",
      "10.0.0.0/8",
      "169.254.0.0/16",
      "172.16.0.0/12",
      "192.168.0.0/16",
      "::1/128",
      "fe80::/10",
      "fc00::/7"
    ]
  },
  "condition": "network_connection and (selection and not 1 of filter_main_*)"
}

False Positives

• ⚠ False positives are expected from ClickOnce manifests hosted on public IPs and domains. Apply additional filters for the accepted IPs in your environement as necessary