Possible threat detected in chrome browser (network.mojom.NetworkService)

GiovanniO — Tue, 27 Feb 2024 23:34:19 GMT

Hello Community

Through Query Center, strange traffic behavior towards different IPs will be detected (Through a third-party firewall, computers trying to reach those IP addresses are quarantined)

Generating a query to find out which computers are trying to reach those IPs, the following remote connection is detected in the actor_process_command_line:

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en --service-sandbox-type=none - -mojo-platform-channel-handle=2720 --field-trial-handle=2528,i,7347107580992436587,426009518194727917,131072 /prefetch:8

It is suspected that this connection may be a threat,

There is the possibility of validating if the command line was executed by an extension or DLL through a Query search?

Thank you for your support.

Re: Possible threat detected in chrome browser (network.mojom.NetworkService)

aspatil — Thu, 14 Mar 2024 09:17:22 GMT

Hello @GiovanniO ,

Thanks for reaching out on LiveCommunity!

Did you get the chance the check the same in Causality View.

If you feel this has answered your query, please let us know by clicking on "mark this as a Solution". Thank you.

topic Possible threat detected in chrome browser (network.mojom.NetworkService) in Cortex XDR Discussions

Possible threat detected in chrome browser (network.mojom.NetworkService)

Re: Possible threat detected in chrome browser (network.mojom.NetworkService)