Dfsvc.EXE Initiated Network Connection Over Uncommon Port — Detection Rule

Detects an initiated network connection over uncommon ports from "dfsvc.exe". A utility used to handled ClickOnce applications.

Read the full analysis on IntelFusions