Microsoft malware protection Update Stub

mpsigstub.exe is a Microsoft executable related to Windows Security updates in Windows 10 or 11. It is visible in Task Manager and can often be seen sucking up resources.

What is Service Host: Microsoft Passport Container in Task Manager?

Microsoft Passport Container is a Win32 service. It manages identity keys to authenticate users to identity providers as well as TPM virtual smart cards. It runs in a shared process of svchost.exe.

Background to TPM:
TPM or Trusted Platform Module was created by an industry consortium called Trusted Computing Group (TCG) and standardized by ISO and IEC in 2009.

Microsoft Passport provides two-factor authentication (often abbreviated 2FA) and also known as multifactor authentication. This adds an extra layer of security when you log in to an account , such as a mobile phone code/OTP, or some piece of information only the user knows.

What is the COM Surrogate in Task Manager?

The COM surrogate (dllhost.exe) runs risky code inside it, so the surrogate crashes instead of Explorer. To understand the COM surrogate, it's important to understand DLL surrogates.

The Windows Client/Server Runtime Subsystem (CSRSS)

csrss.exe is a component of Windows NT family operating systems that runs the user mode (all code outside of the kernel) of the Win32 subsystem.

Image Path Name in Task Manager

We can check the Image Path Name in Task Manager.  Click on View then Select Column. It can be useful to see if common exe files are running from their expected locations. For example, rundll32.exe should run from C:\Windows\system32 or C:\WINNT\system32.

unsecapp.exe

There are strange exe's running in your Task Manager, and unsecapp.exe may be one of them. It describes itself as a "sink to receive asynchronous callbacks for WMI client application". WMI is Windows MANAGEMENT instrumentation where management in this context means "sysadmin" or more fancifully "system management".

Querying the Task Manager Quickly

Doing Cntrl-Alt-Del and running Task Manager is a time-consuming process. Instead, the tasklist command can be used to get a list of running tasks.

For example, if you want to get a list of tasks taking up more than 50Megs in memory then use the "FI" (filter) parameter with tasklist as follows:

tasklist /FI "MEMUSAGE gt 50000"

An easy mistake to make is to type ">" rather than "gt". This will not work. It will give you an error: "ERROR: The search filter cannot be recognised".

On my system this returns just one process:

Image Name PID Session Name Session# Mem Usage
firefox.exe 3120 Console 0 70,116 K

There don't appear to be any built-in sorting functions based on memory or CPU usage, but this is easy to program by parsing the output of tasklist.exe in Python, Perl or some other scripting language. You will need to use tasklist /V (for verbose mode) to see CPU usage information.