Windows Process Access to svchost.exe with High-Rights GrantedAccess

Alerts on high-privilege access to svchost.exe when process call context is UNKNOWN, excluding MSBuild-origin traffic.

FreeReviewedSigma · High · v2

Product: windows
Category: process_access
Author: Tim Burrell (SigmaHQ), DRL 1.1
Published: 2020-01-02
Updated: 2026-07-31

ATT&CK techniques

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags high-privilege access attempts targeting svchost.exe in System32, where the access parameters match a broad granted rights mask and the call context is marked as UNKNOWN. Attackers may use process access to interfere with or impair security-critical components running inside svchost-hosted services, such as by manipulating service-related threads. It relies on Windows process-access telemetry including TargetImage, GrantedAccess, and CallTrace fields, while excluding likely benign MSBuild-driven access patterns.

Reporting behind it

Related detections9 linkedT1685.001 — drag to rearrange

Malicious Security Event Log Disabled via wevtutil

Malicious SQL Server Auditing Deactivated (via application)

Malicious Event Log Deactivation or Size Reduction - Command (via process_creation)

Malicious Audit Policy Disabled by Command Line (via process_creation)

Suspicious IIS Logging Disabled via appcmd

Malicious SQL Server Database Auditing Deactivated (via application)

Malicious Audit Policy Disabled by Command Line (via security)

Malicious Event Log Tampering via wevtutil Channel Disable by FunkSec Ransomware (via process_creation)

OCSP Responder Auditing Settings Changed or Disabled (via security)

Windows Process Access to svchost.exe with High-Rights GrantedAccess

Pivot detection · T1685.001 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

suspicious-windows-svchost-exe-process-access-with-unknown-calltrace-166e9c50

title: Windows Process Access to svchost.exe with High-Rights GrantedAccess
id: 8e83178f-79b7-47dc-a643-cab6bc4fea58
status: test
description: This rule flags high-privilege access attempts targeting svchost.exe in System32, where the access parameters match a broad granted rights mask and the call context is marked as UNKNOWN. Attackers may use process access to interfere with or impair security-critical components running inside svchost-hosted services, such as by manipulating service-related threads. It relies on Windows process-access telemetry including TargetImage, GrantedAccess, and CallTrace fields, while excluding likely benign MSBuild-driven access patterns.
references:
  - https://github.com/hlldz/Invoke-Phant0m
  - https://twitter.com/timbmsft/status/900724491076214784
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_access/proc_access_win_svchost_susp_access_request.yml
author: Tim Burrell, Huntrule Team
date: 2020-01-02
modified: 2023-01-30
tags:
  - attack.defense-impairment
  - attack.t1685.001
logsource:
  category: process_access
  product: windows
detection:
  selection:
    TargetImage|endswith: :\Windows\System32\svchost.exe
    GrantedAccess: "0x1F3FFF"
    CallTrace|contains: UNKNOWN
  filter_main_msbuild:
    SourceImage|contains: :\Program Files\Microsoft Visual Studio\
    SourceImage|endswith: \MSBuild\Current\Bin\MSBuild.exe
    CallTrace|contains:
      - Microsoft.Build.ni.dll
      - System.ni.dll
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 166e9c50-8cd9-44af-815d-d1f0c0e90dde
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL