Suspect Svchost Activity

Hunt Hypothesis

It is extremely abnormal for svchost.exe to spawn without any CLI arguments and is normally observed when a malicious process spawns the process and injects code into the process memory space.

Detection Rule

Sigma (Original)

title: Suspect Svchost Activity
id: 16c37b52-b141-42a5-a3ea-bbe098444397
status: test
description: It is extremely abnormal for svchost.exe to spawn without any CLI arguments and is normally observed when a malicious process spawns the process and injects code into the process memory space.
references:
    - https://web.archive.org/web/20180718061628/https://securitybytes.io/blue-team-fundamentals-part-two-windows-processes-759fe15965e2
author: David Burkett, @signalblur
date: 2019-12-28
modified: 2022-06-27
tags:
    - attack.privilege-escalation
    - attack.stealth
    - attack.t1055
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        CommandLine|endswith: 'svchost.exe'
        Image|endswith: '\svchost.exe'
    filter:
        - ParentImage|endswith:
              - '\rpcnet.exe'
              - '\rpcnetp.exe'
        - CommandLine: null  # no CommandLine value available
    condition: selection and not filter
falsepositives:
    - Rpcnet.exe / rpcnetp.exe which is a lojack style software. https://www.blackhat.com/docs/us-14/materials/us-14-Kamlyuk-Kamluk-Computrace-Backdoor-Revisited.pdf
level: high

KQL (Azure Sentinel)

imProcessCreate
| where (TargetProcessCommandLine endswith "svchost.exe" and TargetProcessName endswith "\\svchost.exe") and (not((((ParentProcessName endswith "\\rpcnet.exe" or ParentProcessName endswith "\\rpcnetp.exe") or (ActingProcessName endswith "\\rpcnet.exe" or ActingProcessName endswith "\\rpcnetp.exe")) or isnull(TargetProcessCommandLine))))

Required Data Sources

False Positive Guidance

• Rpcnet.exe / rpcnetp.exe which is a lojack style software. https://www.blackhat.com/docs/us-14/materials/us-14-Kamlyuk-Kamluk-Computrace-Backdoor-Revisited.pdf

MITRE ATT&CK Context

• Tactic: Privilege Escalation
• Technique: T1055 — T1055

References

• https://web.archive.org/web/20180718061628/https://securitybytes.io/blue-team-fundamentals-part-two-windows-processes-759fe15965e2
• SigmaHQ Rule