huntrule

Suspicious svchost.exe Execution From AppData Roaming Directory

PremiumReviewedSigma · High · v1
Product
windows
Category
process_creation
Author
HuntRule
Published
2026-09-10
Updated
2026-09-10
AnalysisDetection

ATT&CK techniques

Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule detects svchost.exe running from a user AppData Roaming path instead of the System32 directory. The customized Yashma ransomware dropped a malicious svchost.exe copy into %AppData%\\Roaming to masquerade as the legitimate Windows service host. Attackers abuse this trusted name and wrong path to blend malicious execution into normal process activity and evade defenders.

Reporting behind it

Related detections9 linkedT1036.005 — drag to rearrange
Suspicious MicrosoftEdgeUpdate Launched with Dat Config File
Malicious Scheduled Task Masquerading as Defender NisSrv via Schtasks
Malicious PowerShell Masquerading as Windows Terminal in ProgramData (via process_creation)
Suspicious Csrss Process Masquerading Outside System32 (via process_creation)
Suspicious Mimilite Credential Dumper Execution Writing KB-Named Output
Suspicious PikaBot Autorun Persistence Pointing to AppData Microsoft Dropzone via registry_set
Malicious Live Ledger Persistence via Realter HD Audio Run Key via registry_set
Malicious Live Ledger Stealer Execution via Ledger Lives Masquerade via process_creation
Suspicious Svchost Masquerade Execution from Non-System Path
Suspicious svchost.exe Execution From AppData Roaming Directory
Pivot detection · T1036.005 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.