Pretty interesting series of event unfolded. I had a newly installed Windows Image downloaded from Microsoft Dreamspark/Imagine. less 3 weeks old with some security restriction policy, gpos etc. Anyhow I started to notice that I saw Cortana and MS Calculator would appear to use a some TCP traffic. Which Cortana was obvous but the calculator?
So I scanned the machine with Windows Defender, Maleware Bytes Anti Exploit and Rootkit and a Viper Scan.... Nothing on the Calculator. I would see the calculator spawned as a schedule task as well.
Unnerving me. I scanned it with YARA it had signature of using HIjack Network, UDP and TCP sockets, Keylogger, Screenshots, an Audio Dropper, Privalage escalation signatures etc as I suspected.
I since than deleted all the Windows Apps. (which is also DOD STIG requirement)
Has anyone seen this behavior? Any thoughts or explainations? Why Did Malware Bytes and Microsoft fail to detect this as a virus? or exploit? I am almost assuming this is normal behavior?