Windows Terminal Service Parent Process Spawn (svchost.exe termsvcs)

title: Windows Terminal Service Parent Process Spawn (svchost.exe termsvcs)
id: f7015da5-f96d-4e5d-a7b8-b7dd0166fe82
status: test
description: This rule flags process creation events where the parent command line contains both svchost.exe and termsvcs, indicating a child process spawned by the Windows Terminal Services (RDP) service context. Such parent-child behavior can be leveraged during initial access or lateral movement when attackers execute payloads through terminal services. The detection relies on Windows process creation telemetry, specifically parent command line contents and the spawned process image path.
references:
  - https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/rdp-stands-for-really-do-patch-understanding-the-wormable-rdp-vulnerability-cve-2019-0708/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_svchost_termserv_proc_spawn.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2019-05-22
modified: 2023-01-25
tags:
  - attack.initial-access
  - attack.t1190
  - attack.lateral-movement
  - attack.t1210
  - car.2013-07-002
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    ParentCommandLine|contains|all:
      - \svchost.exe
      - termsvcs
  filter_img:
    Image|endswith:
      - \rdpclip.exe
      - :\Windows\System32\csrss.exe
      - :\Windows\System32\wininit.exe
      - :\Windows\System32\winlogon.exe
  filter_null:
    Image: null
  condition: selection and not 1 of filter_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 1012f107-b8f1-4271-af30-5aed2de89b39
    type: derived