Suspicious Process Masquerading As SvcHost.EXE

Status: test
Severity: high
Log source: category process_creation, product windows
Author: Swachchhanda Shrawan Poudel
Source: github.com/SigmaHQ/sigma

Detects a suspicious process that is masquerading as the legitimate "svchost.exe" by naming its binary "svchost.exe" and executing from an uncommon location. Adversaries often disguise their malicious binaries by naming them after legitimate system processes like "svchost.exe" to evade detection.

Known false positives

Unlikely

MITRE ATT&CK coverage

Tactic	Techniques
Stealth	`T1036.005` Masquerading: Match Legitimate Resource Name or Location

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule body

title: Suspicious Process Masquerading As SvcHost.EXE
id: be58d2e2-06c8-4f58-b666-b99f6dc3b6cd
related:
    - id: 01d2e2a1-5f09-44f7-9fc1-24faa7479b6d
      type: similar
    - id: e4a6b256-3e47-40fc-89d2-7a477edd6915
      type: similar
status: test
description: |
    Detects a suspicious process that is masquerading as the legitimate "svchost.exe" by naming its binary "svchost.exe" and executing from an uncommon location.
    Adversaries often disguise their malicious binaries by naming them after legitimate system processes like "svchost.exe" to evade detection.
references:
    - https://tria.ge/240731-jh4crsycnb/behavioral2
    - https://redcanary.com/blog/threat-detection/process-masquerading/
author: Swachchhanda Shrawan Poudel
date: 2024-08-07
tags:
    - attack.stealth
    - attack.t1036.005
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\svchost.exe'
    filter_main_img_location:
        Image:
            - 'C:\Windows\System32\svchost.exe'
            - 'C:\Windows\SysWOW64\svchost.exe'
    filter_main_ofn:
        OriginalFileName: 'svchost.exe'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Unlikely
level: high
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_svchost_masqueraded_execution/info.yml

Stages and Predicates

Stage 0: `condition`

selection and not 1 of filter_main_*

Stage 1: `selection`

selection:
    Image|endswith: '\svchost.exe'

Stage 2: `not filter_main_*`

filter_main_img_location:
    Image:
        - 'C:\Windows\System32\svchost.exe'
        - 'C:\Windows\SysWOW64\svchost.exe'
filter_main_ofn:
    OriginalFileName: 'svchost.exe'

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`Image`	eq	`C:\Windows\SysWOW64\svchost.exe`	`excludes:Image` `field:"Image" value:"C:\Windows\SysWOW64\svchost.exe"`
`Image`	eq	`C:\Windows\System32\svchost.exe`	`excludes:Image` `field:"Image" value:"C:\Windows\System32\svchost.exe"`
`OriginalFileName`	eq	`svchost.exe`	`excludes:OriginalFileName` `field:"OriginalFileName" value:"svchost.exe"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Image`	ends_with	`\svchost.exe` corpus 23 (sigma 22, kusto 1)	`field:"Image" kind:ends_with value:"\svchost.exe"`