svchost.exe

Host Process for Windows Services file version info

Program on Windows LOLRMM Overlord 14 known copies with hashes 80 Sigma rules name it

A file of Overlord

a remote management tool, from LOLRMM

LOLRMM lists a file named svchost.exe as Overlord’s. Overlord is a publicly available cross-platform remote access framework with Go-based agents and a TypeScript/Node/Bun server.

Its sitehttps://github.com/doesntbreaktos/Overlord

From LOLRMM (Apache 2.0), which lists the remote management tools intruders are known to use as well as administrators. It goes by the file’s name: a copy that is the file above is not necessarily Overlord’s.

Is it the real svchost.exe?

file version info and known copies

Installed inC:\Windows\system32\
C:\Windows\SysWOW64\

Signed byMicrosoft Windows

ProductMicrosoft Windows Operating System, Microsoft Corporation

DescriptionHost Process for Windows Services

14 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\svchost.exe · signed by Microsoft Windows

b276aa5385601d8e8b302c4e8eeb3d8682a72861de149beb6bc28726e4ec815b

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\svchost.exe · signed by Microsoft Windows

f56fe75ca483fbe899281d59e94eb40575efc24cc6c09e499ca084986eea13e9

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\svchost.exe · signed by Microsoft Windows

320addc1d6d5f9524da6f9969b10d3dccc6f6505c327b6658652f0e10d0a29b4

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\svchost.exe · signed by Microsoft Windows

39f80b404b2fd80dc096442d77e221cbb3ef5621acf66dcd3829e8af4cc37bf0

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\svchost.exe · signed by Microsoft Windows

5c3257b277f160109071e7e716040e67657341d8c42aa68d9afafe1630fcc53e

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\svchost.exe · signed by Microsoft Windows

643ec58e82e0272c97c2a59f6020970d881af19c0ad5029db9c958c13b6558c7

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\svchost.exe · signed by Microsoft Windows

5be0de7f915ba819d4ba048db7a2a87f6f3253fdd4865dc418181a0d6a031caa

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\svchost.exe · signed by Microsoft Windows

dd191a5b23df92e12a8852291f9fb5ed594b76a28a5a464418442584afd1e048

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\svchost.exe · signed by Microsoft Windows

7fd065bac18c5278777ae44908101cdfed72d26fa741367f0ad4d02020787ab6

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\svchost.exe · signed by Microsoft Windows

d8eceac9d02f7e8aaaca7beeb8dc3ff28a0574e07fb34ca8e6720a6bc1126292

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\svchost.exe · signed by Microsoft Windows

438b6ccd84f4dd32d9684ed7d58fd7d1e5a75fe3f3d12ab6c788e6bb0ffad5e7

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\svchost.exe · signed by Microsoft Windows

710134ffaf3a08d1b217da2f90afd85ae2e0d20f5d8968901b5943b26aa2f44b

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\svchost.exe · signed by Microsoft Windows Publisher

388557172f87d67a033d7b8ea0124246af2e7c041e93fb6cfb35bb9cf733578b

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\svchost.exe · signed by Microsoft Windows Publisher

c7db4ae8175c33a47baa3ddfa089fad17bc8e362f21e835d78ab22c9231fe370

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name svchost.exe

criticalAPT27 - Emissary Panda ActivityFlorian Roth (Nextron Systems)

criticalCOLDSTEEL RAT Cleanup Command ExecutionNasreddine Bencherchali (Nextron Systems)

criticalCOLDSTEEL RAT Service Persistence ExecutionX__Junior (Nextron Systems)

criticalElise Backdoor ActivityFlorian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)

criticalHAFNIUM Exchange Exploitation ActivityFlorian Roth (Nextron Systems)

criticalPotential Dridex ActivityFlorian Roth (Nextron Systems), oscd.community, Nasreddine Bencherchali (Nextron Systems)

highExplorer NOUACCHECK FlagFlorian Roth (Nextron Systems)

highHackTool - Potential Impacket Lateral Movement ActivityEcco, oscd.community, Jonhnathan Ribeiro, Tim Rauch

highImagingDevices Unusual Parent/Child ProcessesNasreddine Bencherchali (Nextron Systems)

highMMC20 Lateral Movement@2xxeformyshirt (Security Risk Advisors) - rule; Teymur Kheirkhabarov (idea)

highPotential Exploitation Attempt Of Undocumented WindowsServer RCEFlorian Roth (Nextron Systems), Nasreddine Bencherchali

highPotential LethalHTA Technique ExecutionMarkus Neis

highPotential Persistence Via Powershell Search Order Hijacking - TaskpH-T (Nextron Systems), Florian Roth (Nextron Systems)

highScript Event Consumer Spawning ProcessSittikorn S

highSuspect Svchost ActivityDavid Burkett, @signalblur

highSuspicious Microsoft Office Child ProcessFlorian Roth (Nextron Systems), Markus Neis, FPT.EagleEye Team, Vadim Khrykov, Cyb3rEng, Michael Haag, Christopher Peacock @securepeacock, @scythe_io

highSuspicious Microsoft OneNote Child ProcessTim Rauch (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Elastic (idea)

highSuspicious Outlook Child ProcessMichael Haag, Florian Roth (Nextron Systems), Markus Neis, Elastic, FPT.EagleEye Team

highSuspicious Process Masquerading As SvcHost.EXESwachchhanda Shrawan Poudel

highSuspicious Service Binary DirectoryFlorian Roth (Nextron Systems)

highSuspicious WebDav Client Execution Via Rundll32.EXENasreddine Bencherchali (Nextron Systems), Florian Roth (Nextron Systems)

highSystem File Execution Location AnomalyFlorian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali (Nextron Systems)

highTerminal Service Process SpawnFlorian Roth (Nextron Systems)

highUAC Bypass Using Disk CleanupChristian Burkard (Nextron Systems)

highUncommon Svchost Command Line ParameterLiran Ravich

highWab/Wabmig Unusual Parent Or Child ProcessesNasreddine Bencherchali (Nextron Systems)

mediumConhost Spawned By Uncommon Parent ProcessTim Rauch, Elastic (idea)

mediumElevated System Shell SpawnedNasreddine Bencherchali (Nextron Systems), frack113

mediumGpscript Executionfrack113

mediumRundll32 Execution With Uncommon DLL ExtensionTim Shelton, Florian Roth (Nextron Systems), Yassine Oukessou

And 6 more process creation rules that name svchost.exe.

Sigma names svchost.exe in 80 rules in all, for every kind of event; these are the process creation rules CmdID evaluates.