Uncommon Svchost Command Line Parameter

Hunt Hypothesis

Detects instances of svchost.exe running with an unusual or uncommon command line parameter by excluding known legitimate or common patterns. This could point at a file masquerading as svchost, a proc

Detection Rule

Sigma (Original)

title: Uncommon Svchost Command Line Parameter
id: f17211f1-1f24-4d0c-829f-31e28dc93cdd
status: experimental
description: |
    Detects instances of svchost.exe running with an unusual or uncommon command line parameter by excluding known legitimate or common patterns.
    This could point at a file masquerading as svchost, a process injection, or hollowing of a legitimate svchost instance.
references:
    - https://cardinalops.com/blog/the-art-of-anomaly-hunting-patterns-detection/
    - https://www.security.com/threat-intelligence/blackbyte-exbyte-ransomware
    - https://cloud.google.com/blog/topics/threat-intelligence/apt41-initiates-global-intrusion-campaign-using-multiple-exploits/
    - https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/08064518/Carbanak_APT_eng.pdf
author: Liran Ravich
date: 2025-11-14
modified: 2026-03-23
tags:
    - attack.privilege-escalation
    - attack.stealth
    - attack.t1036.005
    - attack.t1055
    - attack.t1055.012
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        # Example of command to simulate: "C:\Windows\System32\svchost.exe" calc.exe
        Image|endswith: '\svchost.exe'
    filter_main_flags:
        CommandLine|re: '-k\s\w{1,64}(?:\s?(?:-p|-s))?'
    filter_main_empty:
        CommandLine: ''
    filter_main_null:
        CommandLine: null
    filter_optional_defender:
        ParentImage|endswith: '\MsMpEng.exe'
        CommandLine|contains: 'svchost.exe'
    filter_optional_mrt:
        ParentImage|endswith: '\MRT.exe'
        CommandLine: 'svchost.exe'
    condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
    - Unlikely
level: high

KQL (Azure Sentinel)

imProcessCreate
| where TargetProcessName endswith "\\svchost.exe" and (not((TargetProcessCommandLine matches regex "-k\\s\\w{1,64}(?:\\s?(?:-p|-s))?" or TargetProcessCommandLine =~ "" or isnull(TargetProcessCommandLine)))) and (not((((ParentProcessName endswith "\\MsMpEng.exe" or ActingProcessName endswith "\\MsMpEng.exe") and TargetProcessCommandLine contains "svchost.exe") or ((ParentProcessName endswith "\\MRT.exe" or ActingProcessName endswith "\\MRT.exe") and TargetProcessCommandLine =~ "svchost.exe"))))

Required Data Sources

False Positive Guidance

• Unlikely

MITRE ATT&CK Context

• Tactic: Privilege Escalation
• Technique: T1036.005 — T1036.005
• Technique: T1055 — T1055
• Technique: T1055.012 — T1055.012

References

• https://cardinalops.com/blog/the-art-of-anomaly-hunting-patterns-detection/
• https://www.security.com/threat-intelligence/blackbyte-exbyte-ransomware
• https://cloud.google.com/blog/topics/threat-intelligence/apt41-initiates-global-intrusion-campaign-using-multiple-exploits/
• https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/08064518/Carbanak_APT_eng.pdf
• SigmaHQ Rule