Windows svchost.exe Uncommon Command-Line Parameter Process Creation

ATT&CK techniques

Priv Esc → Defense Evasion

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
- T1055Process Injection
- T1055.012Process Hollowing
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags process creation events where svchost.exe is executed with an uncommon command-line parameter pattern, excluding known legitimate/typical cases and certain benign parent processes. Unusual parameters can indicate masquerading, process tampering, or other stealth techniques involving the host process. The detection relies on Windows process creation telemetry, including Image path and CommandLine content, with filters for specific parent-image scenarios.

Reporting behind it

Related detections9 linkedT1036.005 — drag to rearrange

Suspicious AppLaunch.exe Spawned As Injection Target (via process_creation)

Suspicious svchost Masquerading Executed Outside System Directory

Possible Process Injection Target RegAsm Launched Without Arguments via Process Creation

Windows Defender windefend Event 1119 flags RedSun TieringEngineService.exe EICAR test file

Suspicious ALPHA SPIDER Rclone Exfiltration Tool Masquerading as System Binary (via process_creation)

Suspicious Axios NPM macOS Persistence Masquerading as Apple Service

Suspicious Office Application Spawning Script Or Shell Interpreter

Malicious Spoolsv Process Masquerading From Non-System Path (via process_creation)

Suspicious svchost.exe Execution From AppData Roaming Directory

Windows svchost.exe Uncommon Command-Line Parameter Process Creation

Pivot detection · T1036.005 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-svchost-exe-uncommon-command-line-parameter-process-creation-f17211f1

title: Windows svchost.exe Uncommon Command-Line Parameter Process Creation
id: 83fd3202-4b74-4734-aaf3-679c92016414
status: experimental
description: This rule flags process creation events where svchost.exe is executed with an uncommon command-line parameter pattern, excluding known legitimate/typical cases and certain benign parent processes. Unusual parameters can indicate masquerading, process tampering, or other stealth techniques involving the host process. The detection relies on Windows process creation telemetry, including Image path and CommandLine content, with filters for specific parent-image scenarios.
references:
  - https://cardinalops.com/blog/the-art-of-anomaly-hunting-patterns-detection/
  - https://www.security.com/threat-intelligence/blackbyte-exbyte-ransomware
  - https://cloud.google.com/blog/topics/threat-intelligence/apt41-initiates-global-intrusion-campaign-using-multiple-exploits/
  - https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/08064518/Carbanak_APT_eng.pdf
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_svchost_uncommon_command_line_flags.yml
author: Liran Ravich, Huntrule Team
date: 2025-11-14
modified: 2026-03-23
tags:
  - attack.privilege-escalation
  - attack.stealth
  - attack.t1036.005
  - attack.t1055
  - attack.t1055.012
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: \svchost.exe
  filter_main_flags:
    CommandLine|re: -k\s\w{1,64}(?:\s?(?:-p|-s))?
  filter_main_empty:
    CommandLine: ""
  filter_main_null:
    CommandLine: null
  filter_optional_defender:
    ParentImage|endswith: \MsMpEng.exe
    CommandLine|contains: svchost.exe
  filter_optional_mrt:
    ParentImage|endswith: \MRT.exe
    CommandLine: svchost.exe
  condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: f17211f1-1f24-4d0c-829f-31e28dc93cdd
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL