Possible threat detected in chrome browser (network.mojom.NetworkService)

[GiovanniO]

Hello Community

Through Query Center, strange traffic behavior towards different IPs will be detected (Through a third-party firewall, computers trying to reach those IP addresses are quarantined)

Generating a query to find out which computers are trying to reach those IPs, the following remote connection is detected in the actor_process_command_line:

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en --service-sandbox-type=none - -mojo-platform-channel-handle=2720 --field-trial-handle=2528,i,7347107580992436587,426009518194727917,131072 /prefetch:8

It is suspected that this connection may be a threat,

There is the possibility of validating if the command line was executed by an extension or DLL through a Query search?

Thank you for your support.

[aspatil]

Hello @GiovanniO ,

Thanks for reaching out on LiveCommunity!

Did you get the chance the check the same in Causality View.

If you feel this has answered your query, please let us know by clicking on "mark this as a Solution". Thank you.