Hi Team,
In my network I observed first few desktops are trying to connect to 199[.]59[.]243[.]200 on multiple ports especially on port 445/1433/80/443
After further investigation and captured the logs and processes found that mainly svchost.exe and lsass.exe and sending a connections to this host from all those desktops. There are no processes then getting spawned svchost.exe and lsass.exe.
How do I go further then to find out what exact process is triggering those issues?
Can someone please help?
Â
TIA
Blason R
Further research and collection of logs and processes revealed that the majority of the processes were svchost.exe and lsass.exe, which were sending connections to this host from all of the PCs. The processes svchost.exe and lsass.exe that are launched are the only ones running.