Windows Terminal Service Parent Process Spawn (svchost.exe termsvcs)
Alerts when a new process is spawned under a Terminal Services (termsvcs) host context in Windows.
- Product
- windows
- Category
- process_creation
- Author
- Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2019-05-22
- Updated
- 2026-07-30
ATT&CK techniques
Initial Access → Lateral MovementRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags process creation events where the parent command line contains both svchost.exe and termsvcs, indicating a child process spawned by the Windows Terminal Services (RDP) service context. Such parent-child behavior can be leveraged during initial access or lateral movement when attackers execute payloads through terminal services. The detection relies on Windows process creation telemetry, specifically parent command line contents and the spawned process image path.
Reporting behind it
- securingtomorrow.mcafee.comhttps://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/rdp-stands-for-really-do-patch-understanding-the-wormable-rdp-vulnerability-cve-2019-0708/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_svchost_termserv_proc_spawn.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Terminal Service Parent Process Spawn (svchost.exe termsvcs)
id: f7015da5-f96d-4e5d-a7b8-b7dd0166fe82
status: test
description: This rule flags process creation events where the parent command line contains both svchost.exe and termsvcs, indicating a child process spawned by the Windows Terminal Services (RDP) service context. Such parent-child behavior can be leveraged during initial access or lateral movement when attackers execute payloads through terminal services. The detection relies on Windows process creation telemetry, specifically parent command line contents and the spawned process image path.
references:
- https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/rdp-stands-for-really-do-patch-understanding-the-wormable-rdp-vulnerability-cve-2019-0708/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_svchost_termserv_proc_spawn.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2019-05-22
modified: 2023-01-25
tags:
- attack.initial-access
- attack.t1190
- attack.lateral-movement
- attack.t1210
- car.2013-07-002
logsource:
product: windows
category: process_creation
detection:
selection:
ParentCommandLine|contains|all:
- \svchost.exe
- termsvcs
filter_img:
Image|endswith:
- \rdpclip.exe
- :\Windows\System32\csrss.exe
- :\Windows\System32\wininit.exe
- :\Windows\System32\winlogon.exe
filter_null:
Image: null
condition: selection and not 1 of filter_*
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 1012f107-b8f1-4271-af30-5aed2de89b39
type: derived