Detection rules › Sigma

Dllhost.EXE Initiated Network Connection To Non-Local IP Address

Status
test
Severity
medium
Log source
category network_connection, product windows
Author
bartblaze
Source
github.com/SigmaHQ/sigma

Detects Dllhost.EXE initiating a network connection to a non-local IP address. Aside from Microsoft own IP range that needs to be excluded. Network communication from Dllhost will depend entirely on the hosted DLL. An initial baseline is recommended before deployment.

Known false positives

  • Communication to other corporate systems that use IP addresses from public address spaces

MITRE ATT&CK coverage

Telemetry coverage

ProviderRecord / event type
SysmonEvent ID 3: Network connection

Rule body

title: Dllhost.EXE Initiated Network Connection To Non-Local IP Address
id: cfed2f44-16df-4bf3-833a-79405198b277
status: test
description: |
    Detects Dllhost.EXE initiating a network connection to a non-local IP address.
    Aside from Microsoft own IP range that needs to be excluded. Network communication from Dllhost will depend entirely on the hosted DLL.
    An initial baseline is recommended before deployment.
references:
    - https://redcanary.com/blog/child-processes/
    - https://nasbench.medium.com/what-is-the-dllhost-exe-process-actually-running-ef9fe4c19c08
author: bartblaze
date: 2020-07-13
modified: 2024-07-16
tags:
    - attack.stealth
    - attack.t1218
    - attack.execution
    - attack.t1559.001
    - detection.threat-hunting
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        Image|endswith: '\dllhost.exe'
        Initiated: 'true'
    filter_main_local_ranges:
        DestinationIp|cidr:
            - '::1/128'  # IPv6 loopback
            - '10.0.0.0/8'
            - '127.0.0.0/8'
            - '172.16.0.0/12'
            - '192.168.0.0/16'
            - '169.254.0.0/16'
            - 'fc00::/7'  # IPv6 private addresses
            - 'fe80::/10'  # IPv6 link-local addresses
    filter_main_msrange:
        DestinationIp|cidr:
            - '20.184.0.0/13' # Microsoft Corporation
            - '20.192.0.0/10' # Microsoft Corporation
            - '23.72.0.0/13'  # Akamai International B.V.
            - '51.10.0.0/15'  # Microsoft Corporation
            - '51.103.0.0/16' # Microsoft Corporation
            - '51.104.0.0/15' # Microsoft Corporation
            - '52.224.0.0/11'  # Microsoft Corporation
            - '150.171.0.0/19'  # Microsoft Corporation
            - '204.79.197.0/24' # Microsoft Corporation'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Communication to other corporate systems that use IP addresses from public address spaces
level: medium

Stages and Predicates

Stage 0: condition

selection and not 1 of filter_main_*

Stage 1: selection

selection:
    Image|endswith: '\dllhost.exe'
    Initiated: 'true'

Stage 2: not filter_main_*

filter_main_local_ranges:
    DestinationIp|cidr:
        - '::1/128'
        - '10.0.0.0/8'
        - '127.0.0.0/8'
        - '172.16.0.0/12'
        - '192.168.0.0/16'
        - '169.254.0.0/16'
        - 'fc00::/7'
        - 'fe80::/10'
filter_main_msrange:
    DestinationIp|cidr:
        - '20.184.0.0/13'
        - '20.192.0.0/10'
        - '23.72.0.0/13'
        - '51.10.0.0/15'
        - '51.103.0.0/16'
        - '51.104.0.0/15'
        - '52.224.0.0/11'
        - '150.171.0.0/19'
        - '204.79.197.0/24'

Exclusions

The rule actively suppresses these predicates.

FieldKindExcluded valuesSearch
DestinationIpcidr_match10.0.0.0/8excludes:DestinationIp field:"DestinationIp" value:"10.0.0.0/8"
DestinationIpcidr_match127.0.0.0/8excludes:DestinationIp field:"DestinationIp" value:"127.0.0.0/8"
DestinationIpcidr_match150.171.0.0/19excludes:DestinationIp field:"DestinationIp" value:"150.171.0.0/19"
DestinationIpcidr_match169.254.0.0/16excludes:DestinationIp field:"DestinationIp" value:"169.254.0.0/16"
DestinationIpcidr_match172.16.0.0/12excludes:DestinationIp field:"DestinationIp" value:"172.16.0.0/12"
DestinationIpcidr_match192.168.0.0/16excludes:DestinationIp field:"DestinationIp" value:"192.168.0.0/16"
DestinationIpcidr_match20.184.0.0/13excludes:DestinationIp field:"DestinationIp" value:"20.184.0.0/13"
DestinationIpcidr_match20.192.0.0/10excludes:DestinationIp field:"DestinationIp" value:"20.192.0.0/10"
DestinationIpcidr_match204.79.197.0/24excludes:DestinationIp field:"DestinationIp" value:"204.79.197.0/24"
DestinationIpcidr_match23.72.0.0/13excludes:DestinationIp field:"DestinationIp" value:"23.72.0.0/13"
DestinationIpcidr_match51.10.0.0/15excludes:DestinationIp field:"DestinationIp" value:"51.10.0.0/15"
DestinationIpcidr_match51.103.0.0/16excludes:DestinationIp field:"DestinationIp" value:"51.103.0.0/16"
DestinationIpcidr_match51.104.0.0/15excludes:DestinationIp field:"DestinationIp" value:"51.104.0.0/15"
DestinationIpcidr_match52.224.0.0/11excludes:DestinationIp field:"DestinationIp" value:"52.224.0.0/11"
DestinationIpcidr_match::1/128excludes:DestinationIp field:"DestinationIp" value:"::1/128"
DestinationIpcidr_matchfc00::/7excludes:DestinationIp field:"DestinationIp" value:"fc00::/7"
DestinationIpcidr_matchfe80::/10excludes:DestinationIp field:"DestinationIp" value:"fe80::/10"

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
Imageends_with
  • \dllhost.exe corpus 11 (sigma 11)
field:"Image" kind:ends_with value:"\dllhost.exe"
Initiatedeq
  • true corpus 50 (sigma 50)
field:"Initiated" kind:eq value:"true"