Dfsvc.EXE Initiated Network Connection Over Uncommon Port

SigmaHQ Detections@sigmaHQ

•updated Jun 12, 2025•0•35

Detects an initiated network connection over uncommon ports from "dfsvc.exe". dfsvc.exe is a utility used to handle ClickOnce applications. Adversaries may abuse ClickOnce to proxy execution of malicious code, and unexpected network connections from this process, especially on non-standard ports, could indicate malicious activity.