Malicious traffic Detected C2:Generic-B at Windows;??svchost.exe

Hi bambi long 

Could you help me out with the product details in which you are seeing this alerts?

Form the alert that you have post , I assume it to be Sophos Endpoint protection -Cloud.

If a C2 (command-and-control) detection alert has been triggered this means that the Sophos Endpoint Security product has detected communication with a suspect Command and Control site.

Firstly we need to identify the process that triggered the C2 detection. The following steps must be performed on the endpoint on which the detection was triggered.

• Open the SAV.txt log (C:\ProgramData\Sophos\Sophos Anti-Virus\logs)
• Locate the C2 detection within this file (most recent entries are at the bottom of the file)
• Make a note of the 'Process Path', the exact C2\<name> detection and the 'Threat ID'. The entry in the log will look like this: "File C:\Malware.exe" belongs to virus/spyware 'C2/Generic-B'. Threat ID: 174378266"

Locate the file specified in the 'Process Path'.

If it's a known file:
Many C2 detections will highlight an application which is obviously malicious. However there are certain circumstances where a C2 detection may be triggered against seemingly legitimate applications such as 'svchost.exe'. In these cases it is likely that another application has called the legitimate process and further investigation will be required to identify the actual malicious application.

If it's a unknown file:
Follow the instructions how to submit the sample to Sophos

Hi bambi long 

Could you help me out with the product details in which you are seeing this alerts?

Form the alert that you have post , I assume it to be Sophos Endpoint protection -Cloud.

If a C2 (command-and-control) detection alert has been triggered this means that the Sophos Endpoint Security product has detected communication with a suspect Command and Control site.

Firstly we need to identify the process that triggered the C2 detection. The following steps must be performed on the endpoint on which the detection was triggered.

• Open the SAV.txt log (C:\ProgramData\Sophos\Sophos Anti-Virus\logs)
• Locate the C2 detection within this file (most recent entries are at the bottom of the file)
• Make a note of the 'Process Path', the exact C2\<name> detection and the 'Threat ID'. The entry in the log will look like this: "File C:\Malware.exe" belongs to virus/spyware 'C2/Generic-B'. Threat ID: 174378266"

Locate the file specified in the 'Process Path'.

If it's a known file:
Many C2 detections will highlight an application which is obviously malicious. However there are certain circumstances where a C2 detection may be triggered against seemingly legitimate applications such as 'svchost.exe'. In these cases it is likely that another application has called the legitimate process and further investigation will be required to identify the actual malicious application.

If it's a unknown file:
Follow the instructions how to submit the sample to Sophos

Hi

Gowtham Mani you are completely correct. 

bambi long you shouldn't be looking to exclude that file. Your customer is most likely infected. A C2 detection is very rarely wrong. The svchost.exe file is not your problem, there is something else hiding on the machine that is connecting to a known command and control site and is using the legit svchost.exe to do it. 

Please can you let us know the exact detection details you are getting from the logs/console. Gowtham Mani has provided you the instructions on the post above.