Windows Process Creation: svchost Running NavShExt.dll Deletion/Setting Commands

Alerts on svchost.exe process commands referencing cached NavShExt.dll deletion and execution markers consistent with Elise backdoor activity.

FreeReviewedSigma · Critical · v5

Product: windows
Category: process_creation
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2018-01-31
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Execution

Recon
Resource Dev
Initial Access
Execution
- T1059.003Windows Command Shell
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags Windows process creation events where svchost.exe is launched with command-line activity referencing NavShExt.dll in a Roaming Caches path. It looks for either a command that deletes NavShExt.dll via a cache-related path, or command-line usage that contains the string ',Setting' associated with NavShExt.dll. These behaviors matter because they can indicate execution and cleanup steps used by malicious backdoors, and the rule relies on process creation telemetry including Image and CommandLine fields.

Reporting behind it

Related detections9 linkedT1059.003 — drag to rearrange

Possible Apache ActiveMQ Exploitation via Java Spawning Command Shell (via process_creation)

Suspicious Doenerium Host Fingerprinting via cmd.exe

Suspicious Scheduled Task Creation Referencing dllFake Batch Scripts (via process_creation)

Suspicious Backup Exec Remote Agent Spawning Command Shell via Process Creation (via process_creation)

Suspicious ClickFix Command Execution via RunMRU Registry Key

Suspicious LampoRAT Command Dispatcher via Cmd Delayed Expansion Flags (via process_creation)

Malicious WSUS Service Spawning Command Shell via CVE-2025-59287 (via process_creation)

Malicious SharePoint w3wp Spawning Command Shell and PowerShell

Suspicious extrac32 CAB Extraction Abuse

Windows Process Creation: svchost Running NavShExt.dll Deletion/Setting Commands

Pivot detection · T1059.003 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-process-creation-elise-backdoor-related-dll-deletion-and-execution-via-s-e507feb7

title: "Windows Process Creation: svchost Running NavShExt.dll Deletion/Setting Commands"
id: d1bacdb2-3f1b-4c44-87dc-67d259d2a8dd
status: test
description: This rule flags Windows process creation events where svchost.exe is launched with command-line activity referencing NavShExt.dll in a Roaming Caches path. It looks for either a command that deletes NavShExt.dll via a cache-related path, or command-line usage that contains the string ',Setting' associated with NavShExt.dll. These behaviors matter because they can indicate execution and cleanup steps used by malicious backdoors, and the rule relies on process creation telemetry including Image and CommandLine fields.
references:
  - https://community.rsa.com/community/products/netwitness/blog/2018/02/13/lotus-blossom-continues-asean-targeting
  - https://web.archive.org/web/20200302083912/https://www.accenture.com/t20180127T003755Z_w_/us-en/_acnmedia/PDF-46/Accenture-Security-Dragonfish-Threat-Analysis.pdf
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2018/Malware/Elise-Backdoor/proc_creation_win_malware_elise.yml
author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2018-01-31
modified: 2023-03-09
tags:
  - attack.g0030
  - attack.g0050
  - attack.s0081
  - attack.execution
  - attack.t1059.003
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection_other_svchost:
    Image|endswith: \Microsoft\Network\svchost.exe
  selection_other_del:
    CommandLine|contains|all:
      - \Windows\Caches\NavShExt.dll
      - /c del
  selection_dll_path:
    CommandLine|endswith:
      - \AppData\Roaming\MICROS~1\Windows\Caches\NavShExt.dll
      - \AppData\Roaming\Microsoft\Windows\Caches\NavShExt.dll
  selection_dll_function:
    CommandLine|contains: ",Setting"
  condition: 1 of selection_other_* or all of selection_dll_*
falsepositives:
  - Unlikely
level: critical
license: DRL-1.1
related:
  - id: e507feb7-5f73-4ef6-a970-91bb6f6d744f
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL