Sigma high experimental sigma

Uncommon Svchost Command Line Parameter

Detects instances of svchost.exe running with an unusual or uncommon command line parameter by excluding known legitimate or common patterns. This could point at a file masquerading as svchost, a process injection, or hollowing of a legitimate svchost instance.

View Source

Detection Logic

{
  "selection": {
    "Image
| endswith": "\\svchost.exe"
  },
  "filter_main_flags": {
    "CommandLine
| re": "-k\\s\\w{1,64}(?:\\s?(?:-p
| -s))?"
  },
  "filter_main_empty": {
    "CommandLine": ""
  },
  "filter_main_null": {
    "CommandLine": null
  },
  "filter_optional_defender": {
    "ParentImage
| endswith": "\\MsMpEng.exe",
    "CommandLine
| contains": "svchost.exe"
  },
  "filter_optional_mrt": {
    "ParentImage
| endswith": "\\MRT.exe",
    "CommandLine": "svchost.exe"
  },
  "condition": "selection and not 1 of filter_main_* and not 1 of filter_optional_*"
}

False Positives

  • ⚠ Unlikely

Field Validations

Loading…

Comments (0)

Loading comments...