Windows DLL Side-Loading: svchost.exe Launched from AppData by sllauncher.exe

title: "Windows DLL Side-Loading: svchost.exe Launched from AppData by sllauncher.exe"
id: 9e1180b5-028e-4c4b-b2df-d7088b4bf913
status: test
description: This rule identifies process execution consistent with DLL side-loading activity where sllauncher.exe spawns svchost.exe. It further scopes the behavior to svchost.exe being launched from a parent path under AppData\Roaming and to command lines containing "-k". This pattern is important because such execution chains can enable stealthy loading and persistence mechanisms using trusted system binaries. Telemetry relies on Windows process creation fields including ParentImage, Image, and CommandLine.
references:
  - https://app.any.run/tasks/579e7587-f09d-4aae-8b07-472833262965
  - https://twitter.com/cyb3rops/status/1168863899531132929
  - https://research.nccgroup.com/2018/05/18/emissary-panda-a-potential-new-malicious-tool/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2018/TA/APT27/proc_creation_win_apt_apt27_emissary_panda.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2018-09-03
modified: 2023-03-09
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.execution
  - attack.stealth
  - attack.t1574.001
  - attack.g0027
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection_sllauncher:
    ParentImage|endswith: \sllauncher.exe
    Image|endswith: \svchost.exe
  selection_svchost:
    ParentImage|contains: \AppData\Roaming\
    Image|endswith: \svchost.exe
    CommandLine|contains: -k
  condition: 1 of selection_*
falsepositives:
  - Unlikely
level: critical
license: DRL-1.1
related:
  - id: 9aa01d62-7667-4d3b-acb8-8cb5103e2014
    type: derived