Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 1103710" data-attributes="member: 32260">To see which LOLBin is the issue you must use &lt;Blocked Events&gt; and see which LOLBins are in the LOG. Usually, there can be many events related to Explorer.exe and a few events of rundll32.exe (mainly Windows telemetry).MS Office applications can be exploited and serve as a trojan. But, if you use Microsoft Office 365, such outbound connections are normal. You can use the the DestAdress from the FirewallHardening Logto see where the outbound traffic goes:Event[1]:Local Time:&nbsp; 2024/10/04 11:36:45ProcessID:&nbsp; 14868Application:&nbsp; C:\windows\system32\rundll32.exeDirection:&nbsp; OutboundSourceAddress:&nbsp; 192.168.0.165SourcePort:&nbsp; 54672DestAddress:&nbsp; 51.124.78.146DestPort:&nbsp; 443Protocol:&nbsp; 6.....<a href="https://www.ipvoid.com/whois/" target="_blank">IP Whois Online, Whois Lookup Online | IPVoid</a>[ATTACH=full]285684[/ATTACH]In this case the DestAddress is related to Microsoft.</blockquote>

[QUOTE="Andy Ful, post: 1103710, member: 32260"] To see which LOLBin is the issue you must use <Blocked Events> and see which LOLBins are in the LOG. Usually, there can be many events related to Explorer.exe and a few events of rundll32.exe (mainly Windows telemetry). MS Office applications can be exploited and serve as a trojan. But, if you use Microsoft Office 365, such outbound connections are normal. You can use the the DestAdress from the FirewallHardening Logto see where the outbound traffic goes: Event[1]: Local Time: 2024/10/04 11:36:45 ProcessID: 14868 [COLOR=rgb(184, 49, 47)][B]Application: C:\windows\system32\rundll32.exe[/B][/COLOR] Direction: Outbound SourceAddress: 192.168.0.165 SourcePort: 54672 [COLOR=rgb(184, 49, 47)][B]DestAddress: 51.124.78.146[/B][/COLOR] DestPort: 443 Protocol: 6 ..... [URL='https://www.ipvoid.com/whois/']IP Whois Online, Whois Lookup Online | IPVoid[/URL] [ATTACH type="full" alt="1728035409317.png"]285684[/ATTACH] In this case the DestAddress is related to Microsoft. [/QUOTE]

Verification