dfsvc.exe Initiated Network Connection to Uncommon Ports (Windows)
Alerts on dfsvc.exe-initiated outbound connections targeting non-standard ports on Windows, excluding typical 80/443 and IPv6 DNS(53).
- Product
- windows
- Category
- network_connection
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-06-12
- Updated
- 2026-07-31
ATT&CK techniques
ExecutionRecon
Resource Dev
Initial Access
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags instances where dfsvc.exe initiates an outbound network connection to a destination port other than 80 or 443. Such behavior matters because dfsvc.exe handling ClickOnce-related functionality could be abused for unexpected external communication. The detection relies on Windows network connection telemetry indicating an initiated connection, the process image path ending in \dfsvc.exe under the .NET directory, and the destination port, with optional handling for IPv6 DNS traffic to port 53.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: dfsvc.exe Initiated Network Connection to Uncommon Ports (Windows)
id: 96a1a808-af7a-4d20-a397-ba7b784cf6d4
status: test
description: This rule flags instances where dfsvc.exe initiates an outbound network connection to a destination port other than 80 or 443. Such behavior matters because dfsvc.exe handling ClickOnce-related functionality could be abused for unexpected external communication. The detection relies on Windows network connection telemetry indicating an initiated connection, the process image path ending in \dfsvc.exe under the .NET directory, and the destination port, with optional handling for IPv6 DNS traffic to port 53.
references:
- https://posts.specterops.io/less-smartscreen-more-caffeine-ab-using-clickonce-for-trusted-code-execution-1446ea8051c5
- https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/network_connection/net_connection_win_dfsvc_uncommon_ports.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-06-12
modified: 2024-01-31
tags:
- attack.execution
- attack.t1203
- detection.threat-hunting
logsource:
category: network_connection
product: windows
detection:
selection:
Image|contains: :\Windows\Microsoft.NET\
Image|endswith: \dfsvc.exe
Initiated: "true"
filter_main_known_ports:
DestinationPort:
- 80
- 443
filter_optional_dns_ipv6:
DestinationIsIpv6: "true"
DestinationPort: 53
condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 4c5fba4a-9ef6-4f16-823d-606246054741
type: derived