Uncommon Svchost Parent Process

Title: Uncommon Svchost Parent Process
Status: test
Description:Detects an uncommon svchost parent process
References:
  -Internal Research
Author: Florian Roth (Nextron Systems)
Date: 2017-08-15
modified:2022-06-28
Tags:

• -'attack.stealth'
• -'attack.t1036.005'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection:
    Image|endswith: '\svchost.exe'
  filter_main_generic:
    ParentImage|endswith:
      -'\Mrt.exe'
      -'\MsMpEng.exe'
      -'\ngen.exe'
      -'\rpcnet.exe'
      -'\services.exe'
      -'\TiWorker.exe'

  filter_main_parent_null:
    ParentImage: 'None'
  filter_main_parent_empty:
    ParentImage:
      -'-'
      -''

  condition:selection and not 1 of filter_main_*
Falsepositives:
  -Unknown
Level: medium