Windows svchost.exe Uncommon Command-Line Parameter Process Creation

title: Windows svchost.exe Uncommon Command-Line Parameter Process Creation
id: 83fd3202-4b74-4734-aaf3-679c92016414
status: experimental
description: This rule flags process creation events where svchost.exe is executed with an uncommon command-line parameter pattern, excluding known legitimate/typical cases and certain benign parent processes. Unusual parameters can indicate masquerading, process tampering, or other stealth techniques involving the host process. The detection relies on Windows process creation telemetry, including Image path and CommandLine content, with filters for specific parent-image scenarios.
references:
  - https://cardinalops.com/blog/the-art-of-anomaly-hunting-patterns-detection/
  - https://www.security.com/threat-intelligence/blackbyte-exbyte-ransomware
  - https://cloud.google.com/blog/topics/threat-intelligence/apt41-initiates-global-intrusion-campaign-using-multiple-exploits/
  - https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/08064518/Carbanak_APT_eng.pdf
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_svchost_uncommon_command_line_flags.yml
author: Liran Ravich, Huntrule Team
date: 2025-11-14
modified: 2026-03-23
tags:
  - attack.privilege-escalation
  - attack.stealth
  - attack.t1036.005
  - attack.t1055
  - attack.t1055.012
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: \svchost.exe
  filter_main_flags:
    CommandLine|re: -k\s\w{1,64}(?:\s?(?:-p|-s))?
  filter_main_empty:
    CommandLine: ""
  filter_main_null:
    CommandLine: null
  filter_optional_defender:
    ParentImage|endswith: \MsMpEng.exe
    CommandLine|contains: svchost.exe
  filter_optional_mrt:
    ParentImage|endswith: \MRT.exe
    CommandLine: svchost.exe
  condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: f17211f1-1f24-4d0c-829f-31e28dc93cdd
    type: derived