Spot suspicious network activity in Windows Resource Monitor

Windows Resource Monitor is a built-in Windows tool that reveals which running programs are sending and receiving data. Open it with Win+R, type resmon, and select the Network tab. It can help expose unexpected network activity associated with trojans, spyware, adware, browser hijackers, and other malware without installing a paid utility.

It shows process-level traffic rather than packet contents, so an unfamiliar IP address is not proof of infection. A legitimate application can also host malicious code. Use Resource Monitor to build evidence, compare it with normal behaviour, and avoid ending a Windows service until its identity is confirmed.

This matters for Australian users of retail PCs from JB Hi-Fi or Officeworks, custom gaming rigs assembled in Melbourne, and managed laptops in Sydney or Brisbane. Business systems must consider the Privacy Act 1988 and Notifiable Data Breaches scheme, while the Australian Signals Directorate’s Cyber Security Centre provides national incident guidance.

Open Resource Monitor and set a baseline

On the Network tab, leave grouping on the default process view and watch the Send and Receive columns. A sudden rise in transfer volume while no app is visibly working is worth noting, but streaming calls, cloud backups, and Windows Update can produce the same pattern.

Establish a baseline with the machine idle, then repeat it under one task at a time, such as opening a browser or syncing OneDrive. Note expected applications, data totals, and timing; five minutes of clean observation is more useful than one unexplained spike.

Resource Monitor normally opens without administrator rights, so decline any unnecessary elevation request. Take screenshots before acting and record the exact time; redact account names and other sensitive data before sharing.

Identify unfamiliar network processes

When one process transfers unusual data, note its image name and process ID. Open Task Manager’s Details tab, match the PID, and inspect the file location. Software under Temp, Downloads, or a random AppData folder deserves more scrutiny than a signed program in Program Files.

Attackers can copy Windows component names, so svchost.exe is not conclusive. Open the process Properties, compare its executable path and digital signature, and check the parent process in Task Manager or Process Explorer.

A browser connection may also come from an extension or injected proxy rather than the browser itself. If traffic continues after the browser closes, suspect an add-on or startup process. This guide to browser history theft explains how malicious extensions can alter browsing behaviour and provides a removal workflow.

Read connection details without guessing

Expand the TCP connections view for a selected process. Record the remote IP address, remote port, connection state, and whether traffic is mainly inbound or outbound. Connections on standard ports such as 443 can still be harmful, while unusual high-numbered ports can host legitimate applications.

Repeated short connections to the same endpoint may indicate command-and-control beacons. Regular uploads can suggest data theft, while traffic from a temporary-folder process with an unexpected parent can expose a dropped executable. These are clues, not a diagnosis.

Resource Monitor does not reliably show domain names or packet payloads. For deeper analysis, an administrator may correlate findings with DNS records, firewall logs, or an approved packet analyser. Avoid installing an unknown analyser on a compromised system.

Account for expected Australian traffic

Rule out expected services: Microsoft 365, Teams, OneDrive, Windows Update, Defender, a VPN, online banking, and streaming apps. Australian traffic often reaches overseas content delivery networks, so geography alone is weak evidence. Check the local time, because activity outside working hours can still be scheduled.

Work devices add legitimate remote administration and supplier access. Australian customs brokers and freight operators around Port Botany in Sydney, Melbourne’s logistics precinct, and the Port of Brisbane may use cloud consoles. Confirm expected traffic with IT before treating it as an intrusion.

Ransomware can remain quiet until files are changed, so normal traffic does not clear the machine. If Resource Monitor coincides with rapid file changes or mass renaming, preserve the observations; do not assume a decryptor exists. The German-language HelpRestoreFireMail cleanup guide provides a focused removal reference for that CC ransomware variant.

Classify warning signs by context

Classify the evidence by process, destination, timing, and data direction. A single unexpected connection is less serious than an unsigned program repeatedly uploading data to the same external address. Repeat the observation to distinguish a persistent process from a one-off installer.

Compare addresses with known services and approved software. An IP can represent many users on a shared cloud service, and geolocation can mislead. Mark uncertain results for review rather than declaring malware from one snapshot.

Resource Monitor observation	Likely interpretation	Action
Unknown executable in Temp with outbound traffic	Possible dropped malware	Isolate and scan
Regular uploads from an unfamiliar process	Possible data theft	Record details and notify IT
Short repeated connections to one address	Possible command-and-control	Compare endpoint and process
Browser traffic continues after closure	Extension, proxy, or startup persistence	Review extensions and startup
Familiar Microsoft process to a known service	Often legitimate	Verify path and signature
Localhost connection from an unknown process	Possible local proxy or injector	Inspect parent and child processes

Containment and verification after suspected malware

If evidence suggests active compromise, disconnect the network but leave the device powered if possible, then contact IT or a qualified incident responder. Preserve process names, PIDs, addresses, ports, and timestamps. Do not pay a ransom or delete files before recovery advice.

• Run a Microsoft Defender full scan, followed by an offline scan if needed.
• Upgrade Windows 10 devices, whose support ended on 14 October 2025, and update other applications.
• Remove confirmed malicious extensions and startup entries, using Safe Mode cleanup if persistence returns.
• Reboot and repeat the Resource Monitor baseline.
• Change exposed passwords from a clean device and enable multi-factor authentication.
• Report significant incidents through ACSC ReportCyber and assess OAIC notification duties.

After cleanup, restore known-good backups, rotate credentials from a clean device, enable multi-factor authentication, and watch for renewed outbound traffic. A repeat check should show only the expected baseline; if not, preserve new evidence and escalate rather than deleting random processes.