huntrule

Suspicious svchost Masquerading Executed Outside System Directory

PremiumReviewedSigma · High · v1
Product
windows
Category
process_creation
Author
HuntRule
Published
2026-07-29
Updated
2026-08-28
AnalysisDetection

ATT&CK techniques

Priv Esc → Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule detects a process named svchost.exe running from any location other than the System32 or SysWOW64 directories, matching the GopherWhisper JabGopher component that spawns a fake svchost.exe host for LaxGopher injection. The legitimate service host only executes from System, so a copy elsewhere reveals masquerading and process injection.

Reporting behind it

Related detections9 linkedT1036.005 — drag to rearrange
Windows Defender windefend Event 1119 flags RedSun TieringEngineService.exe EICAR test file
Windows svchost.exe Uncommon Command-Line Parameter Process Creation
Suspicious PowerShell Shellcode Loader via Function Pointer Delegate
Suspicious MicrosoftEdgeUpdate Launched with Dat Config File
Malicious Scheduled Task Masquerading as Defender NisSrv via Schtasks
Malicious PowerShell Masquerading as Windows Terminal in ProgramData (via process_creation)
Suspicious Csrss Process Masquerading Outside System32 (via process_creation)
Suspicious Mimilite Credential Dumper Execution Writing KB-Named Output
Suspicious Named Pipe Created by Kazuar Backdoor for Interprocess Command Channel
Suspicious svchost Masquerading Executed Outside System Directory
Pivot detection · T1036.005 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.