Network connections from processes that should not have any
Attack frameworks often run their agent inside another process: by injecting code into it, or by placing a DLL that a signed program loads. The process then talks to the command-and-control server under a harmless name. In the recordings, Notepad connected out on four machines after an injection or a DLL hijack, and the .NET tool InstallUtil connected out on a fifth. The clean Windows 10 client makes 1,792 connections, from browsers, Office, update and sync services and Windows components. Find the 20 connections from processes that have no reason to use the network.
Hint 1
Image is the process that opened the connection. Ask which programs on a workstation never need the network, not which ones do.
Hint 2
All the attack traffic goes to 10.10.10.5, the lab's server. A real server's address changes from one intrusion to the next; a rule on the process still works.
How to defend against command-and-control traffic from hijacked processes
The rule runs in this browser; it is saved here so you can come back to it.
Events
2,146 events. Search filters the table; it does not affect the result.