Dfsvc.EXE Network Connection To Non-Local IPs

SigmaHQ Detections@sigmaHQ

•updated Feb 3, 2025•1•0•38

Detects network connections initiated by 'dfsvc.exe', which is responsible for handling ClickOnce applications, to non-local IP addresses. This activity can be indicative of malicious ClickOnce abuse for trusted code execution, especially when connecting to external or unexpected destinations.