{"id":"166e9c50-8cd9-44af-815d-d1f0c0e90dde","title":"Suspicious Svchost Process Access","description":"Detects suspicious access to the \"svchost\" process such as that used by Invoke-Phantom to kill the thread of the Windows event logging service.","author":"Tim Burrell","status":"test","level":"high","date":"2020-01-02","modified":"2023-01-30","tags":["attack.defense-impairment","attack.t1685.001"],"technique_ids":["T1685.001"],"logsource":{"category":"process_access","product":"windows"},"falsepositives":["Unknown"],"references":["https://github.com/hlldz/Invoke-Phant0m","https://twitter.com/timbmsft/status/900724491076214784"],"source_path":"rules/windows/process_access/proc_access_win_svchost_susp_access_request.yml","source_sha256":"033b8ee19d35b6a48c9d2c6a0e3c6b8a026d6a92a012efb598d8d009eb7b28e2","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_access/proc_access_win_svchost_susp_access_request.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Suspicious Svchost Process Access\nid: 166e9c50-8cd9-44af-815d-d1f0c0e90dde\nstatus: test\ndescription: Detects suspicious access to the \"svchost\" process such as that used by Invoke-Phantom to kill the thread of the Windows event logging service.\nreferences:\n    - https://github.com/hlldz/Invoke-Phant0m\n    - https://twitter.com/timbmsft/status/900724491076214784\nauthor: Tim Burrell\ndate: 2020-01-02\nmodified: 2023-01-30\ntags:\n    - attack.defense-impairment\n    - attack.t1685.001\nlogsource:\n    category: process_access\n    product: windows\ndetection:\n    selection:\n        TargetImage|endswith: ':\\Windows\\System32\\svchost.exe'\n        GrantedAccess: '0x1F3FFF'\n        CallTrace|contains: 'UNKNOWN'\n    filter_main_msbuild:\n        SourceImage|contains: ':\\Program Files\\Microsoft Visual Studio\\'\n        SourceImage|endswith: '\\MSBuild\\Current\\Bin\\MSBuild.exe'\n        # Just to make sure it's \"really\" .NET :)\n        CallTrace|contains:\n            - 'Microsoft.Build.ni.dll'\n            - 'System.ni.dll'\n    condition: selection and not 1 of filter_main_*\nfalsepositives:\n    - Unknown\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1685.001","id":"T1685.001","name":"Disable or Modify Windows Event Log","page":"techniques/enterprise/T1685.001/"}],"data_path":"data/detection-rules/166e9c50-8cd9-44af-815d-d1f0c0e90dde.json","kind":"sigma"}