Dllhost.exe Outbound Connection to Public IP

F S@Fsdr

•updated Mar 30, 2026•13•0•138

Detects instances where dllhost.exe initiates outbound network connections to public IP addresses. Legitimate dllhost.exe processes rarely need to communicate with the internet. Such connections could indicate compromise through COM object hijacking, process hollowing, or injected code attempting to establish command and control (C2) communication.