dfsvc.exe Initiated Network Connections to Non-Local IP Addresses on Windows

title: dfsvc.exe Initiated Network Connections to Non-Local IP Addresses on Windows
id: 2804c175-064e-4993-95c0-dfb2b73f101d
status: test
description: This rule flags network connections initiated by dfsvc.exe where the destination IP is not in commonly excluded local/private ranges. Attackers may abuse dfsvc.exe associated with ClickOnce handling to communicate externally, so outbound connections to non-local IPs are a useful indicator for investigation. Telemetry relies on Windows network_connection events containing the process image path, initiation status, and destination IP.
references:
  - https://posts.specterops.io/less-smartscreen-more-caffeine-ab-using-clickonce-for-trusted-code-execution-1446ea8051c5
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/network_connection/net_connection_win_dfsvc_non_local_ip.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-06-12
modified: 2024-03-12
tags:
  - attack.execution
  - attack.t1203
  - detection.threat-hunting
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|endswith: \dfsvc.exe
    Initiated: "true"
  filter_main_local_ip:
    DestinationIp|cidr:
      - 127.0.0.0/8
      - 10.0.0.0/8
      - 169.254.0.0/16
      - 172.16.0.0/12
      - 192.168.0.0/16
      - ::1/128
      - fe80::/10
      - fc00::/7
  condition: selection and not 1 of filter_main_*
falsepositives:
  - False positives are expected from ClickOnce manifests hosted on public IPs and domains. Apply additional filters for the accepted IPs in your environement as necessary
level: medium
license: DRL-1.1
related:
  - id: 3c21219b-49b5-4268-bce6-c914ed50f09c
    type: derived