Reply to thread

Message

<blockquote data-quote="AtlBo" data-source="post: 722725" data-attributes="member: 32547">Windows 7 x64.&nbsp; Curious how I should think of this attempted transaction.&nbsp; I did some research, and I have seen this type of activity associated with a vulnerability of the .NET Framework and also straightaway with malware activity.Date/Time: 3/30/2018 9:04:31 PMProcess: [7124]C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exeParent: [5704]C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exeRule: BlockProcessesExecutedFromCSCRule Name: Block processes executed from C Sharp compiler (csc.exe)Command Line: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 &quot;/OUT:C:\Users\&lt;StandardUSER&gt;\AppData\Local\Temp\RESA5D1.tmp&quot; &quot;c:\Users\&lt;Standard USER&gt;\AppData\Local\Temp\CSCA5D0.tmp&quot;Signer: Microsoft CorporationParent Signer: Microsoft CorporationUser/Domain: &lt;StandardUSER&gt;-/&lt;AdminUSER&gt;Integrity Level: MediumMicrosoft running Microsoft, so is this normal activity?&nbsp; Seems odd to me for anything Windows to be working with csc.exe, so I have not excluded the transaction at this point.&nbsp; Thanks for any input...Here is some detailed information on the sequence of the vulnerability breach and some information on a malware that is active in this area of Windows:<a href="https://www.sequretek.com/net-framework-zero-day-vulnerability/" target="_blank">.NET Framework zero day Vulnerability (CVE-2017-8759) - Sequretek</a><a href="https://software.sonicwall.com/applications/gav/index.asp?ev=v&amp;v_id=19030" target="_blank">SonicWALL Security Center</a></blockquote>

[QUOTE="AtlBo, post: 722725, member: 32547"] Windows 7 x64. Curious how I should think of this attempted transaction. I did some research, and I have seen this type of activity associated with a vulnerability of the .NET Framework and also straightaway with malware activity. Date/Time: 3/30/2018 9:04:31 PM Process: [7124]C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe Parent: [5704]C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe Rule: BlockProcessesExecutedFromCSC Rule Name: Block processes executed from C Sharp compiler (csc.exe) Command Line: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\<StandardUSER>\AppData\Local\Temp\RESA5D1.tmp" "c:\Users\<Standard USER>\AppData\Local\Temp\CSCA5D0.tmp" Signer: Microsoft Corporation Parent Signer: Microsoft Corporation User/Domain: <StandardUSER>-/<AdminUSER> Integrity Level: Medium Microsoft running Microsoft, so is this normal activity? Seems odd to me for anything Windows to be working with csc.exe, so I have not excluded the transaction at this point. Thanks for any input... Here is some detailed information on the sequence of the vulnerability breach and some information on a malware that is active in this area of Windows: [URL='https://www.sequretek.com/net-framework-zero-day-vulnerability/'].NET Framework zero day Vulnerability (CVE-2017-8759) - Sequretek[/URL] [URL='https://software.sonicwall.com/applications/gav/index.asp?ev=v&v_id=19030']SonicWALL Security Center[/URL] [/QUOTE]

Verification