Sigma medium test sigma

Dfsvc.EXE Network Connection To Non-Local IPs

Detects network connections from "dfsvc.exe" used to handled ClickOnce applications to non-local IPs

View Source

Detection Logic

{
  "selection": {
    "Image
| endswith": "\\dfsvc.exe",
    "Initiated": "true"
  },
  "filter_main_local_ip": {
    "DestinationIp
| cidr": [
      "127.0.0.0/8",
      "10.0.0.0/8",
      "169.254.0.0/16",
      "172.16.0.0/12",
      "192.168.0.0/16",
      "::1/128",
      "fe80::/10",
      "fc00::/7"
    ]
  },
  "condition": "selection and not 1 of filter_main_*"
}

False Positives

  • ⚠ False positives are expected from ClickOnce manifests hosted on public IPs and domains. Apply additional filters for the accepted IPs in your environement as necessary

Field Validations

Loading…

Comments (0)

Loading comments...