Windows Dllhost.exe Network Connection to Non-Local IP Address

Flags Dllhost.exe initiating outbound connections to non-local destination IPs, excluding local/private and specified benign IP ranges.

FreeUnreviewedSigmamediumv1

windows-dllhost-exe-network-connection-to-non-local-ip-address-cfed2f44

title: Windows Dllhost.exe Network Connection to Non-Local IP Address
id: 700fa8b5-368f-4b2e-a40c-8ad46ef025b9
status: test
description: This rule identifies instances where Dllhost.exe initiates a network connection to a destination IP that is not within common local/private IP ranges. Such activity matters because Dllhost.exe is often used to host DLL code, and unexpected outbound connections can indicate misuse for stealthy execution or persistence. The detection relies on Windows network connection telemetry that includes the initiating process image and destination IP address, with exclusions for local ranges and a set of predefined external IP blocks.
references:
  - https://redcanary.com/blog/child-processes/
  - https://nasbench.medium.com/what-is-the-dllhost-exe-process-actually-running-ef9fe4c19c08
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/network_connection/net_connection_win_dllhost_non_local_ip.yml
author: bartblaze, Huntrule Team
date: 2020-07-13
modified: 2024-07-16
tags:
  - attack.stealth
  - attack.t1218
  - attack.execution
  - attack.t1559.001
  - detection.threat-hunting
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|endswith: \dllhost.exe
    Initiated: "true"
  filter_main_local_ranges:
    DestinationIp|cidr:
      - ::1/128
      - 10.0.0.0/8
      - 127.0.0.0/8
      - 172.16.0.0/12
      - 192.168.0.0/16
      - 169.254.0.0/16
      - fc00::/7
      - fe80::/10
  filter_main_msrange:
    DestinationIp|cidr:
      - 20.184.0.0/13
      - 20.192.0.0/10
      - 23.72.0.0/13
      - 51.10.0.0/15
      - 51.103.0.0/16
      - 51.104.0.0/15
      - 52.224.0.0/11
      - 150.171.0.0/19
      - 204.79.197.0/24
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Communication to other corporate systems that use IP addresses from public address spaces
level: medium
license: DRL-1.1
related:
  - id: cfed2f44-16df-4bf3-833a-79405198b277
    type: derived

What it detects

This rule identifies instances where Dllhost.exe initiates a network connection to a destination IP that is not within common local/private IP ranges. Such activity matters because Dllhost.exe is often used to host DLL code, and unexpected outbound connections can indicate misuse for stealthy execution or persistence. The detection relies on Windows network connection telemetry that includes the initiating process image and destination IP address, with exclusions for local ranges and a set of predefined external IP blocks.

Known false positives

Communication to other corporate systems that use IP addresses from public address spaces

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.