Windows: Alert on Outbound Connections Initiated by dialer.exe (Microsoft Phone Dialer)
Alerts on outbound connections started by Windows dialer.exe, excluding common local and reserved IP ranges.
- Product
- windows
- Category
- network_connection
- Author
- CertainlyP (SigmaHQ), DRL 1.1
- Published
- 2024-04-26
- Updated
- 2026-07-31
ATT&CK techniques
C2Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
Exfiltration
Impact
What it detects
This rule flags outbound network connections where the initiating process is dialer.exe located in Windows\System32. Dialer.exe is a built-in Microsoft utility, so unexpected outbound connectivity may indicate abnormal activity such as process misuse or injection attempting network communication. The detection relies on network connection telemetry that includes the connecting process image path and whether the connection was initiated.
Reporting behind it
- tria.gehttps://tria.ge/240301-rk34sagf5x/behavioral2
- app.any.runhttps://app.any.run/tasks/6720b85b-9c53-4a12-b1dc-73052a78477d
- research.checkpoint.comhttps://research.checkpoint.com/2023/rhadamanthys-v0-5-0-a-deep-dive-into-the-stealers-components/
- strontic.github.iohttps://strontic.github.io/xcyclopedia/library/dialer.exe-0B69655F912619756C704A0BF716B61F.html
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_dialer_initiated_connection.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows: Alert on Outbound Connections Initiated by dialer.exe (Microsoft Phone Dialer)"
id: 17529560-92cf-441f-a358-5b2e56ca0d69
status: test
description: This rule flags outbound network connections where the initiating process is dialer.exe located in Windows\System32. Dialer.exe is a built-in Microsoft utility, so unexpected outbound connectivity may indicate abnormal activity such as process misuse or injection attempting network communication. The detection relies on network connection telemetry that includes the connecting process image path and whether the connection was initiated.
references:
- https://tria.ge/240301-rk34sagf5x/behavioral2
- https://app.any.run/tasks/6720b85b-9c53-4a12-b1dc-73052a78477d
- https://research.checkpoint.com/2023/rhadamanthys-v0-5-0-a-deep-dive-into-the-stealers-components/
- https://strontic.github.io/xcyclopedia/library/dialer.exe-0B69655F912619756C704A0BF716B61F.html
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_dialer_initiated_connection.yml
author: CertainlyP, Huntrule Team
date: 2024-04-26
tags:
- attack.execution
- attack.command-and-control
- attack.t1071.001
logsource:
category: network_connection
product: windows
detection:
selection:
Image|endswith: :\Windows\System32\dialer.exe
Initiated: "true"
filter_main_local_ranges:
DestinationIp|cidr:
- 127.0.0.0/8
- 10.0.0.0/8
- 172.16.0.0/12
- 192.168.0.0/16
- 169.254.0.0/16
- ::1/128
- fe80::/10
- fc00::/7
condition: selection and not 1 of filter_main_*
falsepositives:
- In Modern Windows systems, unable to see legitimate usage of this process, However, if an organization has legitimate purpose for this there can be false positives.
level: high
license: DRL-1.1
related:
- id: 37e4024a-6c80-4d8f-b95d-2e7e94f3a8d1
type: derived