Dllhost.exe Initiates Outbound Network Connection
Detects Dllhost.EXE initiating an outbound network connection to a non-local IP address. Dllhost.exe is a legitimate Windows process that hosts DLL-based COM+ applications. While legitimate network communication from Dllhost.exe can occur, especially for applications it hosts, unexpected connections to external IP addresses (excluding known Microsoft ranges and local networks) can indicate malicious activity. Adversaries may abuse Dllhost.exe for proxy execution or to establish command and control.
Sigma
