X-Recipient:	archive-cygwin AT delorie DOT com
DomainKey-Signature:	a=rsa-sha1; c=nofws; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:to:from:subject:message-id:date:mime-version
	:content-type:content-transfer-encoding; q=dns; s=default; b=HSX
	Jh4iDYYV+PNyOw8Y72/VitoCSf4ji0TdjRruEnertVMiNV84YIaj14qdK3dQAP7Z
	k3jfBE5wOS4P2SnOKBh3JQWH5DKiEHgreKVLLCZCnkju1+dFfnFgbuSxVzzp4hFJ
	44/uD6q2AvJwvbVLroeR1gUcMtehRftHrK7/un7o=
DKIM-Signature:	v=1; a=rsa-sha1; c=relaxed; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:to:from:subject:message-id:date:mime-version
	:content-type:content-transfer-encoding; s=default; bh=XFb8GPqHr
	rNMyjEFsRHsMelhaRQ=; b=V/psfe9epftUINgQCNWIecnai3BA1V8qRY/Ulm2NC
	393h1CzBgexH4DKRin9PwBNDeRn7sZj4/e92DcfM8jlj3byWypgRXtSkFomsLjtJ
	pRpakHtul3Hgy1qMfWxoloi/l18Q/wqA74xkxP8ke6BH8CVPhFoJ+MwFXIdjPM2X
	Rc=
Mailing-List:	contact cygwin-help AT cygwin DOT com; run by ezmlm
List-Id:	<cygwin.cygwin.com>
List-Subscribe:	<mailto:cygwin-subscribe AT cygwin DOT com>
List-Archive:	<http://sourceware.org/ml/cygwin/>
List-Post:	<mailto:cygwin AT cygwin DOT com>
List-Help:	<mailto:cygwin-help AT cygwin DOT com>, <http://sourceware.org/ml/#faqs>
Sender:	cygwin-owner AT cygwin DOT com
Mail-Followup-To:	cygwin AT cygwin DOT com
Delivered-To:	mailing list cygwin AT cygwin DOT com
Authentication-Results:	sourceware.org; auth=none
X-Spam-SWARE-Status:	No, score=-1.9 required=5.0 tests=BAYES_00 autolearn=ham version=3.3.1 spammy=H*u:5.1, interception, observed, H*r:192.168.10
X-HELO:	ecbiz204.inmotionhosting.com
To:	cygwin AT cygwin DOT com
From:	LMH <lmh_users-groups AT molconn DOT com>
Subject:	is it normal for bash.exe, sh.exe, and uname.exe to IPC with svchost.exe
Message-ID:	<eb25d3ee-7468-3886-4167-024d2efb9586@molconn.com>
Date:	Tue, 26 Mar 2019 15:53:48 -0400
User-Agent:	Mozilla/5.0 (Windows NT 5.1; rv:49.0) Gecko/20100101 Firefox/49.0 SeaMonkey/2.46
MIME-Version:	1.0
X-OutGoing-Spam-Status:	No, score=-1.0
X-IsSubscribed:	yes

Hello,

I am trying to run down some odd behavior on my system. I have reset my firewall to
"ask" for most operations and am trying to rebuild my rules.

While running a bash script that I wrote, I get notifications from my firewall that
bash.exe, sh.exe and uname.exe are attempting inter-process communication with
svchost.exe. I also get a notification that a potential threat to network traffic
interception or injection has been detected for the same processes. Blocking this IPC
does not appear to affect anything in how my script runs, so I am wondering what the
purpose of the communication is. The bash script does not make any connections.

I have observed that software that is trying to bypass a firewall and find a back way
onto the internet will often attempt to use svchost.exe to make the connection
because svchost.exe is often given free access by default.

Is there some reason I should be expecting these processes to talk to svchost.exe?

LMH

--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple

- Raw text -