Windows PrivateLog Image Load: svchost.exe loading clfsw32.dll

title: "Windows PrivateLog Image Load: svchost.exe loading clfsw32.dll"
id: 7c5ee44f-2e3a-461b-96aa-e0cbf8744a9f
status: test
description: This rule flags a specific Windows image load sequence where svchost.exe loads clfsw32.dll. The behavior matters because atypical module loading by a system host process can indicate stealth tooling using rarely seen execution patterns. It relies on telemetry that records the initiating image path (Image) and the loaded module path (ImageLoaded).
references:
  - https://web.archive.org/web/20210901184449/https://www.fireeye.com/blog/threat-research/2021/09/unknown-actor-using-clfs-log-files-for-stealth.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/TA/PRIVATELOG/image_load_usp_svchost_clfsw32.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2021-09-07
modified: 2022-10-09
tags:
  - attack.privilege-escalation
  - attack.stealth
  - attack.t1055
  - detection.emerging-threats
logsource:
  category: image_load
  product: windows
detection:
  selection:
    Image|endswith: \svchost.exe
    ImageLoaded|endswith: \clfsw32.dll
  condition: selection
falsepositives:
  - Rarely observed
level: high
license: DRL-1.1
related:
  - id: 33a2d1dd-f3b0-40bd-8baf-7974468927cc
    type: derived