huntrule

Malicious DeadLock Ransomware Dropper Masquerading as svhost.exe (via process_creation)

PremiumReviewedSigma · High · v1
Product
windows
Category
process_creation
Author
HuntRule
Published
2026-09-26
Updated
2026-09-26
AnalysisDetection

ATT&CK techniques

Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule detects execution of svhost.exe, a deliberate misspelling of the legitimate svchost.exe used as the DeadLock ransomware dropper filename reported by Group-IB. Adversaries name the dropper to visually mimic the Windows service host and evade cursory review, so any svhost.exe process is a strong malicious indicator.

Reporting behind it

Related detections9 linkedT1036.005 — drag to rearrange
Malicious MuddyWater Named Payload Execution from ProgramData and Public Paths (via process_creation)
Malicious Masquerading via IEXPLORE.EXE OriginalFileName on Unexpected Image (via process_creation)
Suspicious Masquerading Scheduled Task Impersonating Microsoft Edge Update
Suspicious SearchApp Masquerading Executed Outside System Directory
Malicious FrostyNeighbor ViberPC Renamed Rundll32 DLL Execution
Suspicious Windows Terminal Binary Masquerade From ProgramData via Axios npm Compromise
Malicious Contagious Interview RAT via Masqueraded Service Binary in User Path
Malicious Renamed PowerShell as wt.exe in ProgramData via Axios Compromise
Suspicious osascript Spawning Shell Executing Hidden macOS Payload via Axios Compromise
Malicious DeadLock Ransomware Dropper Masquerading as svhost.exe (via process_creation)
Pivot detection · T1036.005 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.