# Suspicious Process - Services Spawns Process From Windows Directory Root (Thunderbolt)

**URL:** <https://discuss.rapid7.com/t/suspicious-process-services-spawns-process-from-windows-directory-root-thunderbolt/22105>\
**Category:** Alerts\
**Tags:** InsightIDR\
**Created:** [April 19, 2023, 3:01am UTC](https://discuss.rapid7.com/t/suspicious-process-services-spawns-process-from-windows-directory-root-thunderbolt/22105 "2023-04-19T03:01:40Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![nwestra](https://discuss.rapid7.com/letter_avatar_proxy/v4/letter/n/b5e925/32.png) [@nwestra](https://discuss.rapid7.com/u/nwestra)\
**Post date:** [April 19, 2023, 3:01am UTC](https://discuss.rapid7.com/t/suspicious-process-services-spawns-process-from-windows-directory-root-thunderbolt/22105/1 "2023-04-19T03:01:40Z")

</div>

Seeing a number of alerts today involving Thunderbolt services:

C:\Windows\TbtP2pShortcutService.exe  
C:\Windows\ThunderboltService.exe

both signed by Intel, and getting launched by services.exe

Should I worry or is this just Rapid7 crying wolf?