dfsvc.exe Initiated Network Connection on Uncommon Destination Ports (Windows)

title: dfsvc.exe Initiated Network Connection on Uncommon Destination Ports (Windows)
id: 96a1a808-af7a-4d20-a397-ba7b784cf6d4
status: test
description: This rule flags outbound connections initiated by dfsvc.exe when the destination port is not among the commonly allowed ports (80/443) and, if applicable, not DNS over IPv6 (port 53). Attackers may abuse ClickOnce-related components such as dfsvc.exe to blend in while establishing external connectivity on less typical ports. It relies on Windows network connection telemetry capturing process image paths, initiation status, destination IP address family (IPv6), and destination port.
references:
  - https://posts.specterops.io/less-smartscreen-more-caffeine-ab-using-clickonce-for-trusted-code-execution-1446ea8051c5
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/network_connection/net_connection_win_dfsvc_uncommon_ports.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-06-12
modified: 2024-01-31
tags:
  - attack.execution
  - attack.t1203
  - detection.threat-hunting
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|contains: :\Windows\Microsoft.NET\
    Image|endswith: \dfsvc.exe
    Initiated: "true"
  filter_main_known_ports:
    DestinationPort:
      - 80
      - 443
  filter_optional_dns_ipv6:
    DestinationIsIpv6: "true"
    DestinationPort: 53
  condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 4c5fba4a-9ef6-4f16-823d-606246054741
    type: derived