SigmaHQ/rules/windows/process_creation/win_susp_svchost.yml

title: Suspicious Svchost Process
status: experimental
description: Detects a suspicious svchost process start
author: Florian Roth
date: 2017/08/15
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image: '*\svchost.exe'
  filter:
    ParentImage:
      - '*\services.exe'
      - '*\MsMpEng.exe'
  condition: selection and not filter
fields:
  - CommandLine
  - ParentCommandLine
tags:
  - attack.defense_evasion
falsepositives:
  - Unknown
level: high