Windows Dllhost.exe Network Connections to Non-Local IP Addresses
Flags Dllhost.exe initiating outbound connections to non-local destination IPs, excluding local/private and specified benign IP ranges.
- Product
- windows
- Category
- network_connection
- Author
- bartblaze (SigmaHQ), DRL 1.1
- Published
- 2020-07-13
- Updated
- 2026-07-31
ATT&CK techniques
Execution → Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags instances where Dllhost.exe initiates a network connection to a destination IP that is not within defined local or excluded CIDR ranges. Attackers may misuse Dllhost.exe to proxy or execute malicious activity, so unexpected outbound connections can indicate suspicious behavior. The detection relies on Windows network connection telemetry fields for process image name, connection initiation status, and destination IP address.
Reporting behind it
- redcanary.comhttps://redcanary.com/blog/child-processes/
- nasbench.medium.comhttps://nasbench.medium.com/what-is-the-dllhost-exe-process-actually-running-ef9fe4c19c08
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/network_connection/net_connection_win_dllhost_non_local_ip.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Dllhost.exe Network Connections to Non-Local IP Addresses
id: 700fa8b5-368f-4b2e-a40c-8ad46ef025b9
status: test
description: This rule flags instances where Dllhost.exe initiates a network connection to a destination IP that is not within defined local or excluded CIDR ranges. Attackers may misuse Dllhost.exe to proxy or execute malicious activity, so unexpected outbound connections can indicate suspicious behavior. The detection relies on Windows network connection telemetry fields for process image name, connection initiation status, and destination IP address.
references:
- https://redcanary.com/blog/child-processes/
- https://nasbench.medium.com/what-is-the-dllhost-exe-process-actually-running-ef9fe4c19c08
- https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/network_connection/net_connection_win_dllhost_non_local_ip.yml
author: bartblaze, Huntrule Team
date: 2020-07-13
modified: 2024-07-16
tags:
- attack.stealth
- attack.t1218
- attack.execution
- attack.t1559.001
- detection.threat-hunting
logsource:
category: network_connection
product: windows
detection:
selection:
Image|endswith: \dllhost.exe
Initiated: "true"
filter_main_local_ranges:
DestinationIp|cidr:
- ::1/128
- 10.0.0.0/8
- 127.0.0.0/8
- 172.16.0.0/12
- 192.168.0.0/16
- 169.254.0.0/16
- fc00::/7
- fe80::/10
filter_main_msrange:
DestinationIp|cidr:
- 20.184.0.0/13
- 20.192.0.0/10
- 23.72.0.0/13
- 51.10.0.0/15
- 51.103.0.0/16
- 51.104.0.0/15
- 52.224.0.0/11
- 150.171.0.0/19
- 204.79.197.0/24
condition: selection and not 1 of filter_main_*
falsepositives:
- Communication to other corporate systems that use IP addresses from public address spaces
level: medium
license: DRL-1.1
related:
- id: cfed2f44-16df-4bf3-833a-79405198b277
type: derived