Windows: Outbound connections initiated by dialer.exe (Microsoft Phone Dialer)

title: "Windows: Outbound connections initiated by dialer.exe (Microsoft Phone Dialer)"
id: 17529560-92cf-441f-a358-5b2e56ca0d69
status: test
description: This rule flags outbound network connections where dialer.exe initiates the session. Because Phone Dialer is typically a local calling utility, unexpected outbound traffic may indicate process misuse such as injection or command-and-control activity. The detection relies on Windows network connection telemetry that includes the connecting process image path and whether the connection was initiated by the host.
references:
  - https://tria.ge/240301-rk34sagf5x/behavioral2
  - https://app.any.run/tasks/6720b85b-9c53-4a12-b1dc-73052a78477d
  - https://research.checkpoint.com/2023/rhadamanthys-v0-5-0-a-deep-dive-into-the-stealers-components/
  - https://strontic.github.io/xcyclopedia/library/dialer.exe-0B69655F912619756C704A0BF716B61F.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_dialer_initiated_connection.yml
author: CertainlyP, Huntrule Team
date: 2024-04-26
tags:
  - attack.execution
  - attack.command-and-control
  - attack.t1071.001
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|endswith: :\Windows\System32\dialer.exe
    Initiated: "true"
  filter_main_local_ranges:
    DestinationIp|cidr:
      - 127.0.0.0/8
      - 10.0.0.0/8
      - 172.16.0.0/12
      - 192.168.0.0/16
      - 169.254.0.0/16
      - ::1/128
      - fe80::/10
      - fc00::/7
  condition: selection and not 1 of filter_main_*
falsepositives:
  - In Modern Windows systems, unable to see legitimate usage of this process, However, if an organization has legitimate purpose for this there can be false positives.
level: high
license: DRL-1.1
related:
  - id: 37e4024a-6c80-4d8f-b95d-2e7e94f3a8d1
    type: derived