huntrule

Windows Process Masquerading as svchost.exe via Binary Name and Location

Alerts on svchost.exe-named processes launched from non-standard paths with OriginalFileName svchost.exe.

FreeUnreviewedSigmahighv1
title: Windows Process Masquerading as svchost.exe via Binary Name and Location
id: d0681d45-6f2c-4cd3-8d42-7c7fb7a7cda9
related:
  - id: 01d2e2a1-5f09-44f7-9fc1-24faa7479b6d
    type: similar
  - id: e4a6b256-3e47-40fc-89d2-7a477edd6915
    type: similar
  - id: be58d2e2-06c8-4f58-b666-b99f6dc3b6cd
    type: derived
status: test
description: This rule flags Windows process creation events where the executable filename ends with \svchost.exe but the process is not the legitimate svchost.exe from C:\Windows\System32 or C:\Windows\SysWOW64. It also requires that the process has the OriginalFileName set to svchost.exe, indicating intent to masquerade as the legitimate system binary. Masquerading like this is commonly used to evade defenses that rely on process names, so the rule relies on process creation telemetry including Image path and OriginalFileName.
references:
  - https://tria.ge/240731-jh4crsycnb/behavioral2
  - https://redcanary.com/blog/threat-detection/process-masquerading/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_svchost_masqueraded_execution.yml
author: Swachchhanda Shrawan Poudel, Huntrule Team
date: 2024-08-07
tags:
  - attack.stealth
  - attack.t1036.005
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: \svchost.exe
  filter_main_img_location:
    Image:
      - C:\Windows\System32\svchost.exe
      - C:\Windows\SysWOW64\svchost.exe
  filter_main_ofn:
    OriginalFileName: svchost.exe
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Unlikely
level: high
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_svchost_masqueraded_execution/info.yml
license: DRL-1.1

What it detects

This rule flags Windows process creation events where the executable filename ends with \svchost.exe but the process is not the legitimate svchost.exe from C:\Windows\System32 or C:\Windows\SysWOW64. It also requires that the process has the OriginalFileName set to svchost.exe, indicating intent to masquerade as the legitimate system binary. Masquerading like this is commonly used to evade defenses that rely on process names, so the rule relies on process creation telemetry including Image path and OriginalFileName.

Known false positives

  • Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.