0

i noticed in the event viewer that chrome.exe and svchost.exe are connecting to 127.0.0.1 remotely using RDP port 3389 on multiple Pc's . i couldn't figure out why this event happens even though that none of the employee is using chrome remote desktop application and i couldn't replicate this scenario on my own pc does anyone have similar issue?enter image description here

charles nawar
  • 1
  • 1

1 Answers1

0

I have no reputation to comment so I post as an answer. Some of sites are known to perform a port scan of localhost:

https://security.stackexchange.com/questions/232345/ebay-web-site-tries-to-connect-to-wss-localhostxxxxx-is-this-legit-or-they

vkip
  • 11
  • 1
  • 3
  • Hi vkip, and welcome to the community. The link you posted is right on target but in order to make your contribution more useful it is always a good practice to expand or summarise the content of the external resources. Could you edit your answer to add some more context? – MariusPontmercy Oct 05 '21 at 09:06