Techniques
Sample rules
Suspect Svchost Activity
- source: sigma
- technicques:
- t1055
Description
It is extremely abnormal for svchost.exe to spawn without any CLI arguments and is normally observed when a malicious process spawns the process and injects code into the process memory space.
Detection logic
condition: selection and not filter
filter:
- ParentImage|endswith:
- \rpcnet.exe
- \rpcnetp.exe
- CommandLine: null
selection:
CommandLine|endswith: svchost.exe
Image|endswith: \svchost.exe