Reply to thread

Message

<blockquote data-quote="WiseVector" data-source="post: 865734" data-attributes="member: 76851">Hi,After doing some search. I&#039;ve found similar behavior here: <a href="https://security.stackexchange.com/questions/51568/automatic-connection-from-lsass-to-different-ips-is-this-the-usual-behavior" target="_blank">Automatic connection from LSASS to different IPs. Is this the usual behavior?</a>More details: <a href="https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/ee619730(v=ws.10)?redirectedfrom=MSDN" target="_blank">Certificate Revocation Checking in Windows Vista and Windows Server 2008</a>And from this page <a href="https://uptime.netcraft.com/perf/graph?sample=9&amp;mode_p=on&amp;errors=1&amp;range=1d&amp;collector=38,42,39,40,45,43,44&amp;site=ocsp2.globalsign.com%2Fgsdomainvalsha2g2" target="_blank">Performance Report for ocsp2.globalsign.com/gsdomainvalsha2g2 | Netcraft</a> We will know &quot;104.18.20.226 &quot; belongs to globalsign. So don&#039;t worry, you don&#039;t get hacked. It&#039;s just OCSP protocol.CPU usage below 1% is normal. As i mentioned before. WV will scan newly added files. After 2.5 WV will also scan newly allocated memory page so it can detect advanced memory attack techniques. Which include:Reflective Dll Injection,Process Hollowing,Manually PE loading (Exe and Dll),DotnetToJS, Sharpshooter, .Net code in PowerShell.Process DoppelgängingProcess ReimagingMimikatzWV will also scan the system to identify&nbsp; hijacked or remote threads. All of this need to consume CPU. Though we have designed a good algorithm to cache clean memory pages and threads, you will still notice a small amount of CPU usage.</blockquote>

[QUOTE="WiseVector, post: 865734, member: 76851"] Hi, After doing some search. I've found similar behavior here: [URL="https://security.stackexchange.com/questions/51568/automatic-connection-from-lsass-to-different-ips-is-this-the-usual-behavior"]Automatic connection from LSASS to different IPs. Is this the usual behavior?[/URL] More details: [URL="https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/ee619730(v=ws.10)?redirectedfrom=MSDN"]Certificate Revocation Checking in Windows Vista and Windows Server 2008[/URL] And from this page [URL="https://uptime.netcraft.com/perf/graph?sample=9&mode_p=on&errors=1&range=1d&collector=38,42,39,40,45,43,44&site=ocsp2.globalsign.com%2Fgsdomainvalsha2g2"]Performance Report for ocsp2.globalsign.com/gsdomainvalsha2g2 | Netcraft[/URL] We will know "104.18.20.226 " belongs to globalsign. So don't worry, you don't get hacked. It's just OCSP protocol. CPU usage below 1% is normal. As i mentioned before. WV will scan newly added files. After 2.5 WV will also scan newly allocated memory page so it can detect advanced memory attack techniques. Which include: Reflective Dll Injection, Process Hollowing, Manually PE loading (Exe and Dll), DotnetToJS, Sharpshooter, .Net code in PowerShell. Process Doppelgänging Process Reimaging Mimikatz WV will also scan the system to identify hijacked or remote threads. All of this need to consume CPU. Though we have designed a good algorithm to cache clean memory pages and threads, you will still notice a small amount of CPU usage. [/QUOTE]

Verification