EXPLORE
Sign In
← Back to Explore
sigmahighHunting

Dfsvc.EXE Initiated Network Connection Over Uncommon Port

Detects an initiated network connection over uncommon ports from "dfsvc.exe". A utility used to handled ClickOnce applications.

MITRE ATT&CK

T1203
execution

Detection Query

selection:
  Image|contains: :\Windows\Microsoft.NET\
  Image|endswith: \dfsvc.exe
  Initiated: "true"
filter_main_known_ports:
  DestinationPort:
    - 80
    - 443
filter_optional_dns_ipv6:
  DestinationIsIpv6: "true"
  DestinationPort: 53
condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*

Author

Nasreddine Bencherchali (Nextron Systems)

Created

2023-06-12

Data Sources

windowsNetwork Connection Events

Platforms

windows

References

Tags

attack.executionattack.t1203detection.threat-hunting
Raw Content
title: Dfsvc.EXE Initiated Network Connection Over Uncommon Port
id: 4c5fba4a-9ef6-4f16-823d-606246054741
status: test
description: Detects an initiated network connection over uncommon ports from "dfsvc.exe". A utility used to handled ClickOnce applications.
references:
    - https://posts.specterops.io/less-smartscreen-more-caffeine-ab-using-clickonce-for-trusted-code-execution-1446ea8051c5
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-06-12
modified: 2024-01-31
tags:
    - attack.execution
    - attack.t1203
    - detection.threat-hunting
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        Image|contains: ':\Windows\Microsoft.NET\'
        Image|endswith: '\dfsvc.exe'
        Initiated: 'true'
    filter_main_known_ports:
        DestinationPort:
            - 80
            - 443
    filter_optional_dns_ipv6:
        # Based on VT. More than 140 binaries made communication over DNS
        DestinationIsIpv6: 'true'
        DestinationPort: 53
    condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
    - Unknown
level: high