huntrule

Windows Process Creation: svchost.exe Spawned Without Command-Line Arguments

Flags svchost.exe process starts lacking command-line values, excluding rpcnet/rpcnetp parent cases.

FreeReviewedSigma · High · v1
Product
windows
Category
process_creation
Author
David Burkett, @signalblur (SigmaHQ), DRL 1.1
Published
2019-12-28
Updated
2026-07-30
AnalysisDetection

ATT&CK techniques

Priv Esc → Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags Windows process creation events where svchost.exe is launched with no command-line value (no CLI arguments), which is atypical for legitimate activity. Attackers may use this pattern after spawning or otherwise tampering with svchost.exe to carry out stealthy actions within a trusted Windows process context. The detection relies on process creation telemetry, matching Image and CommandLine fields and excluding known rpcnet/rpcnetp parent processes when CommandLine is unavailable.

Reporting behind it

Related detections9 linkedT1055 — drag to rearrange
Malicious AddInProcess32 Network Beacon on PureRAT C2 Ports
Suspicious Payload Staging in ProgramData IntelDriver Folder (via file_event)
Possible DarkGate Process Injection via iTunesHelper Spawning vbc.exe
Suspicious PowerShell Shellcode Loader via Function Pointer Delegate
Suspicious Named Pipe Created by Kazuar Backdoor for Interprocess Command Channel
Suspicious SmallTiger Backdoor DLL Load via Image Load
Suspicious svchost Execution With Anomalous Arguments via DeedRAT (via process_creation)
Suspicious Sang Loader Execution with Install or PassUAC Arguments
Suspicious GodRAT Shellcode Injection via Puppet Argument (via process_creation)
Windows Process Creation: svchost.exe Spawned Without Command-Line Arguments
Pivot detection · T1055 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.