SRT 1 Posted November 3, 2019 Share Posted November 3, 2019 Time;Event;Action;Source;Target;Protocol;Rule/worm name;Application;User 11/3/2019 2:22:08 PM;Communication denied by rule;Blocked;10.128.15.130:49272;23.203.62.19:80;TCP;Deny communication for svchost.exe/CryptSvc;C:\Windows\System32\svchost.exe;NT AUTHORITY\NETWORK SERVICE I blocked without trouble. Would like to know why it is trying to connect. Should it be blocked? Thanks. Link to comment Share on other sites More sharing options...
itman 1,740 Posted November 4, 2019 Share Posted November 4, 2019 Looks like legit outbound traffic to me. Trying to monitor svchost.exe outbound traffic is pretty much an effort in futility. IP address, 23.203.62.19, is Akamai which is used extensively by Microsoft. Link to comment Share on other sites More sharing options...
Recommended Posts