Windows Process Creation: svchost Running NavShExt.dll Deletion/Setting Commands
Alerts on svchost.exe process commands referencing cached NavShExt.dll deletion and execution markers consistent with Elise backdoor activity.
- Product
- windows
- Category
- process_creation
- Author
- Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2018-01-31
- Updated
- 2026-07-31
ATT&CK techniques
ExecutionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows process creation events where svchost.exe is launched with command-line activity referencing NavShExt.dll in a Roaming Caches path. It looks for either a command that deletes NavShExt.dll via a cache-related path, or command-line usage that contains the string ',Setting' associated with NavShExt.dll. These behaviors matter because they can indicate execution and cleanup steps used by malicious backdoors, and the rule relies on process creation telemetry including Image and CommandLine fields.
Reporting behind it
- community.rsa.comhttps://community.rsa.com/community/products/netwitness/blog/2018/02/13/lotus-blossom-continues-asean-targeting
- web.archive.orghttps://web.archive.org/web/20200302083912/https://www.accenture.com/t20180127T003755Z_w_/us-en/_acnmedia/PDF-46/Accenture-Security-Dragonfish-Threat-Analysis.pdf
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2018/Malware/Elise-Backdoor/proc_creation_win_malware_elise.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Process Creation: svchost Running NavShExt.dll Deletion/Setting Commands"
id: d1bacdb2-3f1b-4c44-87dc-67d259d2a8dd
status: test
description: This rule flags Windows process creation events where svchost.exe is launched with command-line activity referencing NavShExt.dll in a Roaming Caches path. It looks for either a command that deletes NavShExt.dll via a cache-related path, or command-line usage that contains the string ',Setting' associated with NavShExt.dll. These behaviors matter because they can indicate execution and cleanup steps used by malicious backdoors, and the rule relies on process creation telemetry including Image and CommandLine fields.
references:
- https://community.rsa.com/community/products/netwitness/blog/2018/02/13/lotus-blossom-continues-asean-targeting
- https://web.archive.org/web/20200302083912/https://www.accenture.com/t20180127T003755Z_w_/us-en/_acnmedia/PDF-46/Accenture-Security-Dragonfish-Threat-Analysis.pdf
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2018/Malware/Elise-Backdoor/proc_creation_win_malware_elise.yml
author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2018-01-31
modified: 2023-03-09
tags:
- attack.g0030
- attack.g0050
- attack.s0081
- attack.execution
- attack.t1059.003
- detection.emerging-threats
logsource:
category: process_creation
product: windows
detection:
selection_other_svchost:
Image|endswith: \Microsoft\Network\svchost.exe
selection_other_del:
CommandLine|contains|all:
- \Windows\Caches\NavShExt.dll
- /c del
selection_dll_path:
CommandLine|endswith:
- \AppData\Roaming\MICROS~1\Windows\Caches\NavShExt.dll
- \AppData\Roaming\Microsoft\Windows\Caches\NavShExt.dll
selection_dll_function:
CommandLine|contains: ",Setting"
condition: 1 of selection_other_* or all of selection_dll_*
falsepositives:
- Unlikely
level: critical
license: DRL-1.1
related:
- id: e507feb7-5f73-4ef6-a970-91bb6f6d744f
type: derived