DomainKey-Signature: a=rsa-sha1; c=nofws; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:to:from:subject:message-id:date:mime-version
	:content-type:content-transfer-encoding; q=dns; s=default; b=HSX
	Jh4iDYYV+PNyOw8Y72/VitoCSf4ji0TdjRruEnertVMiNV84YIaj14qdK3dQAP7Z
	k3jfBE5wOS4P2SnOKBh3JQWH5DKiEHgreKVLLCZCnkju1+dFfnFgbuSxVzzp4hFJ
	44/uD6q2AvJwvbVLroeR1gUcMtehRftHrK7/un7o=
Mailing-List: contact cygwin-help AT cygwin DOT com; run by ezmlm
Sender: cygwin-owner AT cygwin DOT com
Mail-Followup-To: cygwin AT cygwin DOT com
To: cygwin AT cygwin DOT com
From: LMH <lmh_users-groups AT molconn DOT com>
Subject: is it normal for bash.exe, sh.exe, and uname.exe to IPC with svchost.exe
Message-ID: <eb25d3ee-7468-3886-4167-024d2efb9586@molconn.com>
Date: Tue, 26 Mar 2019 15:53:48 -0400
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:49.0) Gecko/20100101 Firefox/49.0 SeaMonkey/2.46
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 7bit

Hello,

I am trying to run down some odd behavior on my system. I have reset my firewall to
"ask" for most operations and am trying to rebuild my rules.

While running a bash script that I wrote, I get notifications from my firewall that
bash.exe, sh.exe and uname.exe are attempting inter-process communication with
svchost.exe. I also get a notification that a potential threat to network traffic
interception or injection has been detected for the same processes. Blocking this IPC
does not appear to affect anything in how my script runs, so I am wondering what the
purpose of the communication is. The bash script does not make any connections.

I have observed that software that is trying to bypass a firewall and find a back way
onto the internet will often attempt to use svchost.exe to make the connection
because svchost.exe is often given free access by default.

Is there some reason I should be expecting these processes to talk to svchost.exe?

LMH

--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple