DoSvc (Delivery Optimization)

• Executable: svchost.exe -k DoSvc

• Purpose: Manages the download and upload of Windows updates.

• Intent: To optimize the retrieval of Windows updates by allowing PCs to get updates from, and send updates to, local PCs and the internet.

• Normal Activity: Downloading or distributing updates, especially when updates are released. Background data transfer might be seen.

• Malicious Use: An attacker might mimic its behavior to exfiltrate data or download malicious payloads, as the service legitimately downloads large amounts of data.