Systeminfo.exe Making Network Connection
Detects network connections originating from the systeminfo.exe process. This activity is suspicious because systeminfo.exe is a legitimate system enumeration tool not typically expected to initiate outbound network connections. This behavior has been observed in malware campaigns, such as CountLoader, which injects a cryptocurrency clipper into systeminfo.exe to communicate with C2 servers and the Ethereum blockchain.
Cortex XDR
