huntrule

Windows Process Creation: Potential Pre-auth RCE Exploitation via DHCPServer svchost

Alerts on svchost.exe running as Network Service with -k DHCPServer, suggesting a potential pre-auth Windows RCE attempt.

FreeUnreviewedSigmahighv1
title: "Windows Process Creation: Potential Pre-auth RCE Exploitation via DHCPServer svchost"
id: 34104fa4-7967-415d-8cdd-fe53dc758a05
status: test
description: This rule flags Windows process creation events where svchost.exe is launched with the DHCPServer service parameters, running as the Network Service account. The behavior is indicative of attempts to exploit a pre-auth remote code execution pathway during early connection handling. It relies on process creation telemetry, specifically the process image and parent image ending in svchost.exe, plus matching command-line arguments containing -k DHCPServer and user identity containing Network Service localized variants.
references:
  - https://github.com/SigmaHQ/sigma/pull/3946
  - https://twitter.com/hackerfantastic/status/1616455335203438592?s=20
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Exploits/Windows-Server-Unknown-Exploit/proc_creation_win_exploit_other_win_server_undocumented_rce.yml
author: Florian Roth (Nextron Systems), Nasreddine Bencherchali, Huntrule Team
date: 2023-01-21
tags:
  - attack.initial-access
  - attack.t1190
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \svchost.exe
    Image|endswith: \svchost.exe
    ParentCommandLine|contains: -k DHCPServer
    CommandLine|contains: -k DHCPServer
    User|contains:
      - NETWORK SERVICE
      - NETZWERKDIENST
      - SERVIZIO DI RETE
      - SERVICIO DE RED
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 6d5b8176-d87d-4402-8af4-53aee9db7b5d
    type: derived

What it detects

This rule flags Windows process creation events where svchost.exe is launched with the DHCPServer service parameters, running as the Network Service account. The behavior is indicative of attempts to exploit a pre-auth remote code execution pathway during early connection handling. It relies on process creation telemetry, specifically the process image and parent image ending in svchost.exe, plus matching command-line arguments containing -k DHCPServer and user identity containing Network Service localized variants.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.