Sigma high test sigma

Dfsvc.EXE Initiated Network Connection Over Uncommon Port

Detects an initiated network connection over uncommon ports from "dfsvc.exe". A utility used to handled ClickOnce applications.

View Source

Detection Logic

{
  "selection": {
    "Image
| contains": ":\\Windows\\Microsoft.NET\\",
    "Image
| endswith": "\\dfsvc.exe",
    "Initiated": "true"
  },
  "filter_main_known_ports": {
    "DestinationPort": [
      80,
      443
    ]
  },
  "filter_optional_dns_ipv6": {
    "DestinationIsIpv6": "true",
    "DestinationPort": 53
  },
  "condition": "selection and not 1 of filter_main_* and not 1 of filter_optional_*"
}

False Positives

  • ⚠ Unknown

Field Validations

Loading…

Comments (0)

Loading comments...