Uncommon Svchost Parent Process

Hunt Hypothesis

Detects an uncommon svchost parent process

Detection Rule

Sigma (Original)

title: Uncommon Svchost Parent Process
id: 01d2e2a1-5f09-44f7-9fc1-24faa7479b6d
status: test
description: Detects an uncommon svchost parent process
references:
    - Internal Research
author: Florian Roth (Nextron Systems)
date: 2017-08-15
modified: 2022-06-28
tags:
    - attack.stealth
    - attack.t1036.005
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\svchost.exe'
    filter_main_generic:
        ParentImage|endswith:
            - '\Mrt.exe'
            - '\MsMpEng.exe'
            - '\ngen.exe'
            - '\rpcnet.exe'
            - '\services.exe'
            - '\TiWorker.exe'
    filter_main_parent_null:
        ParentImage: null
    filter_main_parent_empty:
        ParentImage:
            - '-'
            - ''
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Unknown
level: medium

KQL (Azure Sentinel)

imProcessCreate
| where TargetProcessName endswith "\\svchost.exe" and (not((((ParentProcessName endswith "\\Mrt.exe" or ParentProcessName endswith "\\MsMpEng.exe" or ParentProcessName endswith "\\ngen.exe" or ParentProcessName endswith "\\rpcnet.exe" or ParentProcessName endswith "\\services.exe" or ParentProcessName endswith "\\TiWorker.exe") or (ActingProcessName endswith "\\Mrt.exe" or ActingProcessName endswith "\\MsMpEng.exe" or ActingProcessName endswith "\\ngen.exe" or ActingProcessName endswith "\\rpcnet.exe" or ActingProcessName endswith "\\services.exe" or ActingProcessName endswith "\\TiWorker.exe")) or (isnull(ParentProcessName) or isnull(ActingProcessName)) or ((ParentProcessName in~ ("-", "")) or (ActingProcessName in~ ("-", ""))))))

Required Data Sources

False Positive Guidance

• Unknown

MITRE ATT&CK Context

• Technique: T1036.005 — T1036.005

References

• Internal Research
• SigmaHQ Rule