huntrule

Suspicious Windows svchost.exe Process Access with UNKNOWN CallTrace

Alerts on high-privilege access to svchost.exe when process call context is UNKNOWN, excluding MSBuild-origin traffic.

FreeUnreviewedSigmahighv1
title: Suspicious Windows svchost.exe Process Access with UNKNOWN CallTrace
id: 8e83178f-79b7-47dc-a643-cab6bc4fea58
status: test
description: This rule flags Windows process access events targeting svchost.exe with a high-privilege GrantedAccess value while the CallTrace is reported as UNKNOWN. Such access to a core service host process can indicate defense impairment or service tampering by attempting to manipulate threads or handles. The detection relies on Windows process access telemetry including TargetImage, GrantedAccess, and CallTrace, with exclusion for access originating from MSBuild.exe under the Visual Studio directory.
references:
  - https://github.com/hlldz/Invoke-Phant0m
  - https://twitter.com/timbmsft/status/900724491076214784
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_access/proc_access_win_svchost_susp_access_request.yml
author: Tim Burrell, Huntrule Team
date: 2020-01-02
modified: 2023-01-30
tags:
  - attack.defense-impairment
  - attack.t1685.001
logsource:
  category: process_access
  product: windows
detection:
  selection:
    TargetImage|endswith: :\Windows\System32\svchost.exe
    GrantedAccess: "0x1F3FFF"
    CallTrace|contains: UNKNOWN
  filter_main_msbuild:
    SourceImage|contains: :\Program Files\Microsoft Visual Studio\
    SourceImage|endswith: \MSBuild\Current\Bin\MSBuild.exe
    CallTrace|contains:
      - Microsoft.Build.ni.dll
      - System.ni.dll
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 166e9c50-8cd9-44af-815d-d1f0c0e90dde
    type: derived

What it detects

This rule flags Windows process access events targeting svchost.exe with a high-privilege GrantedAccess value while the CallTrace is reported as UNKNOWN. Such access to a core service host process can indicate defense impairment or service tampering by attempting to manipulate threads or handles. The detection relies on Windows process access telemetry including TargetImage, GrantedAccess, and CallTrace, with exclusion for access originating from MSBuild.exe under the Visual Studio directory.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.