An endpoint detection and response (EDR) tool alerts that a process named 'svchost.exe' is running from the path 'C:\Users\Public\svchost.exe' and is making outbound connections. Why is this suspicious?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because legitimate svchost.exe resides exclusively in C:\Windows\System32 (or SysWOW64); an instance in a user-writable path like C:\Users\Public is a classic masquerading technique where malware disguises itself as a Windows system process. A is wrong because legitimate svchost.exe does make network connections; the issue is the file path, not the network activity.
Full explanation below image
Full Explanation
B is correct because legitimate svchost.exe resides exclusively in C:\Windows\System32 (or SysWOW64); an instance in a user-writable path like C:\Users\Public is a classic masquerading technique where malware disguises itself as a Windows system process. A is wrong because legitimate svchost.exe does make network connections; the issue is the file path, not the network activity. C is wrong because the alert is valid; path-based anomalies are a strong indicator of masquerading. D is wrong because no legitimate Windows update mechanism places svchost.exe in user-accessible directories.