Windows Process Creation: svchost.exe Spawned Without Command-Line Arguments

title: "Windows Process Creation: svchost.exe Spawned Without Command-Line Arguments"
id: f1f1e3c2-aec3-4fdb-9bb4-6173ac78c03f
status: test
description: This rule flags Windows process creation events where svchost.exe is launched with no command-line value (no CLI arguments), which is atypical for legitimate activity. Attackers may use this pattern after spawning or otherwise tampering with svchost.exe to carry out stealthy actions within a trusted Windows process context. The detection relies on process creation telemetry, matching Image and CommandLine fields and excluding known rpcnet/rpcnetp parent processes when CommandLine is unavailable.
references:
  - https://web.archive.org/web/20180718061628/https://securitybytes.io/blue-team-fundamentals-part-two-windows-processes-759fe15965e2
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_svchost_execution_with_no_cli_flags.yml
author: David Burkett, @signalblur, Huntrule Team
date: 2019-12-28
modified: 2022-06-27
tags:
  - attack.privilege-escalation
  - attack.stealth
  - attack.t1055
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|endswith: svchost.exe
    Image|endswith: \svchost.exe
  filter:
    - ParentImage|endswith:
        - \rpcnet.exe
        - \rpcnetp.exe
    - CommandLine: null
  condition: selection and not filter
falsepositives:
  - Rpcnet.exe / rpcnetp.exe which is a lojack style software. https://www.blackhat.com/docs/us-14/materials/us-14-Kamlyuk-Kamluk-Computrace-Backdoor-Revisited.pdf
level: high
license: DRL-1.1
related:
  - id: 16c37b52-b141-42a5-a3ea-bbe098444397
    type: derived