CmdID

CmdID / Rules / Windows

Suspect Svchost Activity

A Sigma rule for process creation on Windows, by David Burkett, @signalblur.

high 1 ATT&CK technique 1 program it names

What it looks for

its detection, as SigmaHQ writes it
detection:
  filter:
    - ParentImage|endswith:
        - '\rpcnet.exe'
        - '\rpcnetp.exe'
    - CommandLine: null
  selection:
    CommandLine|endswith: 'svchost.exe'
    Image|endswith: '\svchost.exe'
  condition: selection and not filter

The rule’s detection, its selections and fields in order of name. The whole rule, with its references and false positives, is on SigmaHQ, by David Burkett, @signalblur, under the Detection Rule License 1.1. CmdID evaluates it on a command line alone: a test on what a command line cannot show, such as the parent process or the user, is not met.

None of the everyday examples and documented commands on CmdID’s program pages trips it. To see whether a command line does, paste it into CmdID.

Programs and files it names

their pages here
svchost.exe

ATT&CK

the techniques it is tagged with
T1055Process Injection

Other rules for T1055 Process Injection

Dllhost.EXE Execution Anomaly · HackTool - CoercedPotato Execution · HackTool - DInjector PowerShell Cradle Execution · Injected Browser Process Spawning Rundll32 - GuLoader Activity · Lummac Stealer Activity - Execution Of More.com And Vbc.exe · Potential Process Injection Via Msra.EXE · Suspicious Rundll32 Invoking Inline VBScript · Suspicious Cross-User Process Spawn · Execution Of Non-Existing File · Potential Executable Run Itself As Sacrificial Process · Process Creation Using Sysnative Folder · Suspicious Userinit Child Process