detection.wiki

Detection rules › Sigma

Uncommon Svchost Command Line Parameter

Status
experimental
Severity
high
Log source
product windows, category process_creation
Author
Liran Ravich
Source
github.com/SigmaHQ/sigma

Detects instances of svchost.exe running with an unusual or uncommon command line parameter by excluding known legitimate or common patterns. This could point at a file masquerading as svchost, a process injection, or hollowing of a legitimate svchost instance.

MITRE ATT&CK coverage

TacticTechniques
Privilege EscalationT1055.012 Process Injection: Process Hollowing
StealthT1036.005 Masquerading: Match Legitimate Resource Name or Location, T1055.012 Process Injection: Process Hollowing

Event coverage

ProviderEventTitle
SysmonEvent ID 1Process creation
Security-AuditingEvent ID 4688A new process has been created.

Rule body yaml

title: Uncommon Svchost Command Line Parameter
id: f17211f1-1f24-4d0c-829f-31e28dc93cdd
status: experimental
description: |
    Detects instances of svchost.exe running with an unusual or uncommon command line parameter by excluding known legitimate or common patterns.
    This could point at a file masquerading as svchost, a process injection, or hollowing of a legitimate svchost instance.
references:
    - https://cardinalops.com/blog/the-art-of-anomaly-hunting-patterns-detection/
    - https://www.security.com/threat-intelligence/blackbyte-exbyte-ransomware
    - https://cloud.google.com/blog/topics/threat-intelligence/apt41-initiates-global-intrusion-campaign-using-multiple-exploits/
    - https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/08064518/Carbanak_APT_eng.pdf
author: Liran Ravich
date: 2025-11-14
modified: 2026-03-23
tags:
    - attack.privilege-escalation
    - attack.stealth
    - attack.t1036.005
    - attack.t1055
    - attack.t1055.012
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        # Example of command to simulate: "C:\Windows\System32\svchost.exe" calc.exe
        Image|endswith: '\svchost.exe'
    filter_main_flags:
        CommandLine|re: '-k\s\w{1,64}(?:\s?(?:-p|-s))?'
    filter_main_empty:
        CommandLine: ''
    filter_main_null:
        CommandLine: null
    filter_optional_defender:
        ParentImage|endswith: '\MsMpEng.exe'
        CommandLine|contains: 'svchost.exe'
    filter_optional_mrt:
        ParentImage|endswith: '\MRT.exe'
        CommandLine: 'svchost.exe'
    condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
    - Unlikely
level: high

Stages and Predicates

Stage 0: condition

selection and not 1 of filter_main_* and not 1 of filter_optional_*

Stage 1: selection

selection:
    Image|endswith: '\svchost.exe'

Stage 2: not filter_main_*

filter_main_flags:
    CommandLine|re: '-k\s\w{1,64}(?:\s?(?:-p|-s))?'
filter_main_empty:
    CommandLine: ''
filter_main_null:
    CommandLine: null

Stage 3: not filter_optional_*

filter_optional_defender:
    ParentImage|endswith: '\MsMpEng.exe'
    CommandLine|contains: 'svchost.exe'
filter_optional_mrt:
    ParentImage|endswith: '\MRT.exe'
    CommandLine: 'svchost.exe'

Exclusions

Top-level NOT(...) conjuncts: predicates this rule actively suppresses.

FieldKindExcluded values
CommandLineis_null(no value, null check)
CommandLineregex_match-k\s\w{1,64}(?:\s?(?:-p|-s))?
CommandLineeqsvchost.exe
ParentImageends_with\MRT.exe
CommandLinematchsvchost.exe
ParentImageends_with\MsMpEng.exe

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
Imageends_with
  • \svchost.exe corpus 23 (sigma 23)