Windows Process Creation: svchost DHCPServer RCE Exploitation Attempt
Alerts on svchost.exe running as Network Service with -k DHCPServer, suggesting a potential pre-auth Windows RCE attempt.
- Product
- windows
- Category
- process_creation
- Author
- Florian Roth (Nextron Systems), Nasreddine Bencherchali (SigmaHQ), DRL 1.1
- Published
- 2023-01-21
- Updated
- 2026-07-31
ATT&CK techniques
Initial AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
Flags process creation where both the parent and the spawned process are svchost.exe and the command lines include "-k DHCPServer". This targets suspicious pre-auth remote code execution style exploitation behavior involving the Windows DHCPServer service hosted by svchost under the Network Service account. The rule relies on process creation telemetry including Image, ParentImage, command line arguments, and the user identity.
Reporting behind it
- github.comhttps://github.com/SigmaHQ/sigma/pull/3946
- twitter.comhttps://twitter.com/hackerfantastic/status/1616455335203438592?s=20
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Exploits/Windows-Server-Unknown-Exploit/proc_creation_win_exploit_other_win_server_undocumented_rce.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Process Creation: svchost DHCPServer RCE Exploitation Attempt"
id: 34104fa4-7967-415d-8cdd-fe53dc758a05
status: test
description: Flags process creation where both the parent and the spawned process are svchost.exe and the command lines include "-k DHCPServer". This targets suspicious pre-auth remote code execution style exploitation behavior involving the Windows DHCPServer service hosted by svchost under the Network Service account. The rule relies on process creation telemetry including Image, ParentImage, command line arguments, and the user identity.
references:
- https://github.com/SigmaHQ/sigma/pull/3946
- https://twitter.com/hackerfantastic/status/1616455335203438592?s=20
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Exploits/Windows-Server-Unknown-Exploit/proc_creation_win_exploit_other_win_server_undocumented_rce.yml
author: Florian Roth (Nextron Systems), Nasreddine Bencherchali, Huntrule Team
date: 2023-01-21
tags:
- attack.initial-access
- attack.t1190
- detection.emerging-threats
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith: \svchost.exe
Image|endswith: \svchost.exe
ParentCommandLine|contains: -k DHCPServer
CommandLine|contains: -k DHCPServer
User|contains:
- NETWORK SERVICE
- NETZWERKDIENST
- SERVIZIO DI RETE
- SERVICIO DE RED
condition: selection
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 6d5b8176-d87d-4402-8af4-53aee9db7b5d
type: derived