Windows svchost RPCSS Service Spawns Suspicious Child Process Attempt

Alerts on svchost.exe running RPCSS spawning anomalous child processes indicative of potential RPC abuse.

FreeUnreviewedSigmahighv1

windows-svchost-rpcss-service-spawns-suspicious-child-process-attempt-a7cd7306

title: Windows svchost RPCSS Service Spawns Suspicious Child Process Attempt
id: e0955686-32cd-45cf-8aa2-0a2d0f7daf56
status: test
description: This rule flags process creation events where svchost.exe hosting the RPCSS service (svchost.exe with a command line containing '-k RPCSS') spawns a child process that matches the rule’s expected anomaly pattern. Such behavior matters because attackers may leverage RPC-related services to execute payloads through spawned processes. It relies on Windows process creation telemetry capturing parent image, parent command line, and the resulting child process activity.
references:
  - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26809
  - https://www.bleepingcomputer.com/startups/RpcSs.exe-14544.html
  - https://twitter.com/cyb3rops/status/1514217991034097664
  - https://www.securonix.com/blog/cve-2022-26809-remote-procedure-call-runtime-remote-code-execution-vulnerability-and-coverage/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2022/Exploits/CVE-2022-26809/proc_creation_win_exploit_cve_2022_26809_rpcss_child_process_anomaly.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-04-13
modified: 2023-02-03
tags:
  - attack.initial-access
  - attack.t1190
  - attack.execution
  - attack.t1569.002
  - cve.2022-26809
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage: C:\Windows\System32\svchost.exe
    ParentCommandLine|contains: -k RPCSS
  condition: selection
falsepositives:
  - Unknown
  - Some cases in which the service spawned a werfault.exe process
level: high
license: DRL-1.1
related:
  - id: a7cd7306-df8b-4398-b711-6f3e4935cf16
    type: derived

What it detects

This rule flags process creation events where svchost.exe hosting the RPCSS service (svchost.exe with a command line containing '-k RPCSS') spawns a child process that matches the rule’s expected anomaly pattern. Such behavior matters because attackers may leverage RPC-related services to execute payloads through spawned processes. It relies on Windows process creation telemetry capturing parent image, parent command line, and the resulting child process activity.

Known false positives

Unknown
Some cases in which the service spawned a werfault.exe process

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.