Windows svchost.exe Uncommon Command-Line Parameter Process Creation
Alerts on Windows process starts of svchost.exe that include an uncommon -k parameter format, after excluding common and benign patterns.
- Product
- windows
- Category
- process_creation
- Author
- Liran Ravich (SigmaHQ), DRL 1.1
- Published
- 2025-11-14
- Updated
- 2026-07-30
ATT&CK techniques
Priv Esc → Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags process creation events where svchost.exe is executed with an uncommon command-line parameter pattern, excluding known legitimate/typical cases and certain benign parent processes. Unusual parameters can indicate masquerading, process tampering, or other stealth techniques involving the host process. The detection relies on Windows process creation telemetry, including Image path and CommandLine content, with filters for specific parent-image scenarios.
Reporting behind it
- cardinalops.comhttps://cardinalops.com/blog/the-art-of-anomaly-hunting-patterns-detection/
- security.comhttps://www.security.com/threat-intelligence/blackbyte-exbyte-ransomware
- cloud.google.comhttps://cloud.google.com/blog/topics/threat-intelligence/apt41-initiates-global-intrusion-campaign-using-multiple-exploits/
- media.kasperskycontenthub.comhttps://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/08064518/Carbanak_APT_eng.pdf
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_svchost_uncommon_command_line_flags.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows svchost.exe Uncommon Command-Line Parameter Process Creation
id: 83fd3202-4b74-4734-aaf3-679c92016414
status: experimental
description: This rule flags process creation events where svchost.exe is executed with an uncommon command-line parameter pattern, excluding known legitimate/typical cases and certain benign parent processes. Unusual parameters can indicate masquerading, process tampering, or other stealth techniques involving the host process. The detection relies on Windows process creation telemetry, including Image path and CommandLine content, with filters for specific parent-image scenarios.
references:
- https://cardinalops.com/blog/the-art-of-anomaly-hunting-patterns-detection/
- https://www.security.com/threat-intelligence/blackbyte-exbyte-ransomware
- https://cloud.google.com/blog/topics/threat-intelligence/apt41-initiates-global-intrusion-campaign-using-multiple-exploits/
- https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/08064518/Carbanak_APT_eng.pdf
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_svchost_uncommon_command_line_flags.yml
author: Liran Ravich, Huntrule Team
date: 2025-11-14
modified: 2026-03-23
tags:
- attack.privilege-escalation
- attack.stealth
- attack.t1036.005
- attack.t1055
- attack.t1055.012
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith: \svchost.exe
filter_main_flags:
CommandLine|re: -k\s\w{1,64}(?:\s?(?:-p|-s))?
filter_main_empty:
CommandLine: ""
filter_main_null:
CommandLine: null
filter_optional_defender:
ParentImage|endswith: \MsMpEng.exe
CommandLine|contains: svchost.exe
filter_optional_mrt:
ParentImage|endswith: \MRT.exe
CommandLine: svchost.exe
condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
- Unlikely
level: high
license: DRL-1.1
related:
- id: f17211f1-1f24-4d0c-829f-31e28dc93cdd
type: derived