Windows Terminal Service Parent Process Spawn (svchost.exe termsvcs)

Alerts when a new process is spawned under a Terminal Services (termsvcs) host context in Windows.

FreeReviewedSigma · High · v1

Product: windows
Category: process_creation
Author: Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2019-05-22
Updated: 2026-07-30

ATT&CK techniques

Initial Access → Lateral Movement

Recon
Resource Dev
Initial Access
- T1190Exploit Public-Facing Application
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
- T1210Exploitation of Remote Services
Collection
C2
Exfiltration
Impact

What it detects

This rule flags process creation events where the parent command line contains both svchost.exe and termsvcs, indicating a child process spawned by the Windows Terminal Services (RDP) service context. Such parent-child behavior can be leveraged during initial access or lateral movement when attackers execute payloads through terminal services. The detection relies on Windows process creation telemetry, specifically parent command line contents and the spawned process image path.

Reporting behind it

Related detections9 linkedT1190 — drag to rearrange

Possible .NET Remoting Deserialisation Exploitation via REM Endpoint

Possible xrdp RCE Exploitation via ts_info_utf16_in Buffer Overflow (via application)

Zeek HTTP POST to /wsman without Authorization — Possible OMIGOD unauthenticated RCE (CVE-2021-38647)

Apache thread assertion error in error.log

Suspicious PraisonAI Unauthenticated Config Endpoint Access via Webserver

Malicious Langflow Build Public Temp RCE Access via Webserver

Suspicious PraisonAI Vulnerability Scanner User Agent via Webserver

Malicious LiteLLM Authentication SQL Injection via Web Request (via webserver)

Possible Marimo Unauthenticated Terminal WebSocket Access via Web Request (via webserver)

Windows Terminal Service Parent Process Spawn (svchost.exe termsvcs)

Pivot detection · T1190 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-terminal-service-parent-process-spawn-svchost-exe-termsvcs-1012f107

title: Windows Terminal Service Parent Process Spawn (svchost.exe termsvcs)
id: f7015da5-f96d-4e5d-a7b8-b7dd0166fe82
status: test
description: This rule flags process creation events where the parent command line contains both svchost.exe and termsvcs, indicating a child process spawned by the Windows Terminal Services (RDP) service context. Such parent-child behavior can be leveraged during initial access or lateral movement when attackers execute payloads through terminal services. The detection relies on Windows process creation telemetry, specifically parent command line contents and the spawned process image path.
references:
  - https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/rdp-stands-for-really-do-patch-understanding-the-wormable-rdp-vulnerability-cve-2019-0708/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_svchost_termserv_proc_spawn.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2019-05-22
modified: 2023-01-25
tags:
  - attack.initial-access
  - attack.t1190
  - attack.lateral-movement
  - attack.t1210
  - car.2013-07-002
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    ParentCommandLine|contains|all:
      - \svchost.exe
      - termsvcs
  filter_img:
    Image|endswith:
      - \rdpclip.exe
      - :\Windows\System32\csrss.exe
      - :\Windows\System32\wininit.exe
      - :\Windows\System32\winlogon.exe
  filter_null:
    Image: null
  condition: selection and not 1 of filter_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 1012f107-b8f1-4271-af30-5aed2de89b39
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL