Can an average user protect himself against process injection at some level?

Question

I downloaded a program called Process Monitor from Microsoft Store. I see suspicious IP addresses popping up among my cod.exe processes. Moreover, these suspicious IP addresses are communicating through the xbox port while I'm playing on PC. Also it found a Cobalt folder on my C drive, which if I search for it, I can't find anything.

I don't have any cracked or pirated software on my PC.

What can I do?

There are pictures attached.

Answer 1

To answer your top-level question: sort of, but not really. Processes have ACLs (just like files and registry keys), and it's possible to modify that ACL. Normally other processes are allowed to modify the process' memory, which is generally required for injecting new code into a process. You can remove and even deny this permission, which will prevent other processes from interacting with yours. HOWEVER, that doesn't necessarily solve anything. First, because any other non-sandboxed process running under your account can override the ACL (you - and therefore all processes you run - are the owner of the ACL and can always modify it). Second, because there are other ways to get injection, such as DLL planting, certain registry keys, or outright modifying the executable binary (though these might require the injecting user to be an Administrator... mind you, Administrators can also override ACLs, and also stores like Steam, etc. often install games where non-admins can modify them).

For what it's worth, the UDP packets that cod.exe is sending do look pretty weird, but they aren't necessarily malicious. They could be part of an anti-cheat system. They could also just be part of playing the game, if it communicates with multiple servers or with other players' PCs directly. The traffic your copy is sending might not be unusual at all.