Windows svchost.exe Spawned by Uncommon Parent Process

title: Windows svchost.exe Spawned by Uncommon Parent Process
id: 8af42975-a5ce-486c-b5fe-ca1001804f6d
status: test
description: This rule flags process creation events where the child process is svchost.exe and the parent process is not among a set of common Windows service-related binaries. Attackers may use svchost as a living-off-the-land style proxy to blend in with normal Windows activity, so deviations in the parent lineage can be a useful stealth indicator. It relies on process creation telemetry that includes Image and ParentImage values, specifically matching svchost.exe by filename and excluding known benign parents.
references:
  - Internal Research
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_svchost_uncommon_parent_process.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2017-08-15
modified: 2022-06-28
tags:
  - attack.stealth
  - attack.t1036.005
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: \svchost.exe
  filter_main_generic:
    ParentImage|endswith:
      - \Mrt.exe
      - \MsMpEng.exe
      - \ngen.exe
      - \rpcnet.exe
      - \services.exe
      - \TiWorker.exe
  filter_main_parent_null:
    ParentImage: null
  filter_main_parent_empty:
    ParentImage:
      - "-"
      - ""
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 01d2e2a1-5f09-44f7-9fc1-24faa7479b6d
    type: derived