topic Re: We are detecting suspicius DNS request from svhosts.exe process in windows server in Off Topic

We are detecting suspicius DNS request from svhosts.exe process in windows server

Carlos_Jara — Sun, 05 Dec 2021 17:26:27 GMT

Hi,

We are detecting suspicius DNS request from svhosts.exe process in windows server.

Checkpoint block this connections via GeoPolicy.

How can I know the process or application that use svhosts.exe to send DNS query to external servers?

Re: We are detecting suspicius DNS request from svhosts.exe process in windows server

the_rock — Sun, 05 Dec 2021 19:55:10 GMT

Hm...does not really seem like fw issue, as its doing what its supposed to do. I found below online, not sure if might help you.

https://www.glasswire.com/process/svchost.exe.html

Andy

Re: We are detecting suspicius DNS request from svhosts.exe process in windows server

Carlos_Jara — Sun, 05 Dec 2021 21:22:44 GMT

Hi,

The svchost.exe is a safe windows process, but I don't know why lunch DNS query to external servers when we was define internar DNS in the server.

Checkpoint firewall works fine and block this traffic with GeoPolicy.

Many thank's for your help!

Re: We are detecting suspicius DNS request from svhosts.exe process in windows server

the_rock — Sun, 05 Dec 2021 21:29:55 GMT

That, Im really no sure, apologies. Im not much of a Windows person myself, but it definitely appears its something to do with that server. Does it happen only on one machine or multiple?

Re: We are detecting suspicius DNS request from svhosts.exe process in windows server

Carlos_Jara — Sun, 05 Dec 2021 21:34:09 GMT

I detect this in only one server!

Re: We are detecting suspicius DNS request from svhosts.exe process in windows server

the_rock — Sun, 05 Dec 2021 21:37:04 GMT

So what I would do is maybe compare DNS settings with other machines and if its same, possibly reboot or shut down might help. As old school Microsoft support "motto" goes...reboot 3 times, just in case 🙂