huntrule

Malicious Svchost Impersonation From Non-System Path via process_creation

PremiumReviewedSigma · High · v1
Product
windows
Category
process_creation
Author
HuntRule
Published
2026-10-08
Updated
2026-10-08
AnalysisDetection

ATT&CK techniques

Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule detects a process named svchost.exe running from a directory outside the Windows system folders which is a classic masquerading technique. In the DeepSeek-themed campaign a renamed python.exe was executed as svchost.exe to blend with legitimate service host processes while running a KCP tunnel backdoor. The real svchost.exe only launches from System32 or SysWOW64 so other paths reliably indicate malware.

Reporting behind it

Related detections9 linkedT1036.005 — drag to rearrange
Malicious Desktop Window Manager Impersonation From Non-System Path via process_creation
Malicious RustyStealer Masquerading as AudioDriver in Windows Temp
Suspicious svchost Invocation with Non-Standard svcr Argument
Suspicious Scheduled Task Masquerading as Microsoft Edge Update Machine MS
Malicious Netcat Reverse Shell via Masqueraded StartMenuExperienceHost
Suspicious Head Mare srvhost.exe Masquerading as System Service Host
Suspicious Masqueraded Exfiltration Utility AuditSvc Execution (via process_creation)
Suspicious WerFault Masquerade Executing From Non-System Path Linked to Turla Snake
Suspicious MsMpEng Execution from Non-Standard Directory
Malicious Svchost Impersonation From Non-System Path via process_creation
Pivot detection · T1036.005 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.