
title: Dllhost Internet Connection
author: bartblaze
date: 2020/07/13
description: Detects Dllhost that communicates with public IP addresses
detection:
  SELECTION_1:
    EventID: 3
  SELECTION_2:
    Image: '*\dllhost.exe'
  SELECTION_3:
    Initiated: 'true'
  SELECTION_4:
    DestinationIp:
    - 10.*
    - 192.168.*
    - 172.16.*
    - 172.17.*
    - 172.18.*
    - 172.19.*
    - 172.20.*
    - 172.21.*
    - 172.22.*
    - 172.23.*
    - 172.24.*
    - 172.25.*
    - 172.26.*
    - 172.27.*
    - 172.28.*
    - 172.29.*
    - 172.30.*
    - 172.31.*
    - 127.*
  condition: (SELECTION_1 and (SELECTION_2 and SELECTION_3) and  not (SELECTION_4))
falsepositives:
- Communication to other corporate systems that use IP addresses from public address
  spaces
id: cfed2f44-16df-4bf3-833a-79405198b277
level: medium
logsource:
  category: network_connection
  product: windows
modified: 2020/08/24
references:
- https://github.com/Neo23x0/sigma/blob/master/rules/windows/network_connection/sysmon_rundll32_net_connections.yml
status: experimental
tags:
- attack.defense_evasion
- attack.t1218
- attack.execution
- attack.t1559.001
- attack.t1175
ruletype: SIGMA
