Sigma rule: Dllhost.EXE Initiated Network Connection To Non-Local IP Address

Rule

Title

Dllhost.EXE Initiated Network Connection To Non-Local IP Address

Status

test

Level

medium

Author

bartblaze

Date

2020-07-13

Modified

2024-07-16

File

rules-threat-hunting/windows/network_connection/net_connection_win_dllhost_non_local_ip.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects Dllhost.EXE initiating a network connection to a non-local IP address.
Aside from Microsoft own IP range that needs to be excluded. Network communication from Dllhost will depend entirely on the hosted DLL.
An initial baseline is recommended before deployment.

Log source

product

windows

category

network_connection

Detection

selection:
    Image|endswith: '\dllhost.exe'
    Initiated: 'true'
filter_main_local_ranges:
    DestinationIp|cidr:
        - '::1/128'  # IPv6 loopback
        - '10.0.0.0/8'
        - '127.0.0.0/8'
        - '172.16.0.0/12'
        - '192.168.0.0/16'
        - '169.254.0.0/16'
        - 'fc00::/7'  # IPv6 private addresses
        - 'fe80::/10'  # IPv6 link-local addresses
filter_main_msrange:
    DestinationIp|cidr:
        - '20.184.0.0/13' # Microsoft Corporation
        - '20.192.0.0/10' # Microsoft Corporation
        - '23.72.0.0/13'  # Akamai International B.V.
        - '51.10.0.0/15'  # Microsoft Corporation
        - '51.103.0.0/16' # Microsoft Corporation
        - '51.104.0.0/15' # Microsoft Corporation
        - '52.224.0.0/11'  # Microsoft Corporation
        - '150.171.0.0/19'  # Microsoft Corporation
        - '204.79.197.0/24' # Microsoft Corporation'
condition: selection and not 1 of filter_main_*

False positives (as the rule lists them)

• Communication to other corporate systems that use IP addresses from public address spaces

Tags

• attack.stealth
• attack.t1218
• attack.execution
• attack.t1559.001
• detection.threat-hunting

MITRE ATT&CK ids this rule names

• T1218
• T1559.001

References

• https://redcanary.com/blog/child-processes/
• https://nasbench.medium.com/what-is-the-dllhost-exe-process-actually-running-ef9fe4c19c08

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-threat-hunting/windows/network_connection/net_connection_win_dllhost_non_local_ip.yml