huntrule

Windows Process Masquerading as svchost.exe via Binary Name and Location

Alerts on svchost.exe-named processes launched from non-standard paths with OriginalFileName svchost.exe.

FreeReviewedSigma · High · v1
Product
windows
Category
process_creation
Author
Swachchhanda Shrawan Poudel (SigmaHQ), DRL 1.1
Published
2024-08-07
Updated
2026-07-30
AnalysisDetection

ATT&CK techniques

Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags Windows process creation events where the executable filename ends with \svchost.exe but the process is not the legitimate svchost.exe from C:\Windows\System32 or C:\Windows\SysWOW64. It also requires that the process has the OriginalFileName set to svchost.exe, indicating intent to masquerade as the legitimate system binary. Masquerading like this is commonly used to evade defenses that rely on process names, so the rule relies on process creation telemetry including Image path and OriginalFileName.

Reporting behind it

Related detections9 linkedT1036.005 — drag to rearrange
Suspicious ALPHA SPIDER Rclone Exfiltration Tool Masquerading as System Binary (via process_creation)
Suspicious Axios NPM macOS Persistence Masquerading as Apple Service
Malicious Spoolsv Process Masquerading From Non-System Path (via process_creation)
Suspicious svchost.exe Execution From AppData Roaming Directory
Malicious StyleSmuggler (CVE-2026-75650) Post-Exploitation Implant Process (via process_creation)
Malicious WezRat Persistence via Chrome Updater Run Key
Malicious ValleyRAT RuntimeBroker Masquerade in RunTime Directory
Suspicious Execution of spools.exe from Public Directory
Malicious Fake Fortinet Patch Infostealer Execution (via process_creation)
Windows Process Masquerading as svchost.exe via Binary Name and Location
Pivot detection · T1036.005 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.