Windows: Alert on Outbound Connections Initiated by dialer.exe (Microsoft Phone Dialer)

title: "Windows: Alert on Outbound Connections Initiated by dialer.exe (Microsoft Phone Dialer)"
id: 17529560-92cf-441f-a358-5b2e56ca0d69
status: test
description: This rule flags outbound network connections where the initiating process is dialer.exe located in Windows\System32. Dialer.exe is a built-in Microsoft utility, so unexpected outbound connectivity may indicate abnormal activity such as process misuse or injection attempting network communication. The detection relies on network connection telemetry that includes the connecting process image path and whether the connection was initiated.
references:
  - https://tria.ge/240301-rk34sagf5x/behavioral2
  - https://app.any.run/tasks/6720b85b-9c53-4a12-b1dc-73052a78477d
  - https://research.checkpoint.com/2023/rhadamanthys-v0-5-0-a-deep-dive-into-the-stealers-components/
  - https://strontic.github.io/xcyclopedia/library/dialer.exe-0B69655F912619756C704A0BF716B61F.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_dialer_initiated_connection.yml
author: CertainlyP, Huntrule Team
date: 2024-04-26
tags:
  - attack.execution
  - attack.command-and-control
  - attack.t1071.001
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|endswith: :\Windows\System32\dialer.exe
    Initiated: "true"
  filter_main_local_ranges:
    DestinationIp|cidr:
      - 127.0.0.0/8
      - 10.0.0.0/8
      - 172.16.0.0/12
      - 192.168.0.0/16
      - 169.254.0.0/16
      - ::1/128
      - fe80::/10
      - fc00::/7
  condition: selection and not 1 of filter_main_*
falsepositives:
  - In Modern Windows systems, unable to see legitimate usage of this process, However, if an organization has legitimate purpose for this there can be false positives.
level: high
license: DRL-1.1
related:
  - id: 37e4024a-6c80-4d8f-b95d-2e7e94f3a8d1
    type: derived