Dfsvc.EXE Initiated Network Connection Over Uncommon Port

Status: test
Severity: high
Log source: category network_connection, product windows
Author: Nasreddine Bencherchali (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects an initiated network connection over uncommon ports from "dfsvc.exe". A utility used to handled ClickOnce applications.

MITRE ATT&CK coverage

Tactic	Techniques
Execution	`T1203` Exploitation for Client Execution

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 3: Network connection

Rule body

title: Dfsvc.EXE Initiated Network Connection Over Uncommon Port
id: 4c5fba4a-9ef6-4f16-823d-606246054741
status: test
description: Detects an initiated network connection over uncommon ports from "dfsvc.exe". A utility used to handled ClickOnce applications.
references:
    - https://posts.specterops.io/less-smartscreen-more-caffeine-ab-using-clickonce-for-trusted-code-execution-1446ea8051c5
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-06-12
modified: 2024-01-31
tags:
    - attack.execution
    - attack.t1203
    - detection.threat-hunting
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        Image|contains: ':\Windows\Microsoft.NET\'
        Image|endswith: '\dfsvc.exe'
        Initiated: 'true'
    filter_main_known_ports:
        DestinationPort:
            - 80
            - 443
    filter_optional_dns_ipv6:
        # Based on VT. More than 140 binaries made communication over DNS
        DestinationIsIpv6: 'true'
        DestinationPort: 53
    condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
    - Unknown
level: high

Stages and Predicates

Stage 0: `condition`

selection and not 1 of filter_main_* and not 1 of filter_optional_*

Stage 1: `selection`

selection:
    Image|contains: ':\Windows\Microsoft.NET\'
    Image|endswith: '\dfsvc.exe'
    Initiated: 'true'

Stage 2: `not filter_main_known_ports`

filter_main_known_ports:
    DestinationPort:
        - 80
        - 443

Stage 3: `not filter_optional_dns_ipv6`

filter_optional_dns_ipv6:
    DestinationIsIpv6: 'true'
    DestinationPort: 53

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`DestinationPort`	eq	`443`	`excludes:DestinationPort` `field:"DestinationPort" value:"443"`
`DestinationPort`	eq	`80`	`excludes:DestinationPort` `field:"DestinationPort" value:"80"`
`DestinationIsIpv6`	eq	`true`	`excludes:DestinationIsIpv6` `field:"DestinationIsIpv6" value:"true"`
`DestinationPort`	eq	`53`	`excludes:DestinationPort` `field:"DestinationPort" value:"53"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Image`	ends_with	`\dfsvc.exe` corpus 2 (sigma 2)	`field:"Image" kind:ends_with value:"\dfsvc.exe"`
`Image`	match	`:\Windows\Microsoft.NET\`	`field:"Image" kind:match value:":\Windows\Microsoft.NET\"`
`Initiated`	eq	`true` corpus 50 (sigma 50)	`field:"Initiated" kind:eq value:"true"`