{"id":"be58d2e2-06c8-4f58-b666-b99f6dc3b6cd","title":"Suspicious Process Masquerading As SvcHost.EXE","description":"Detects a suspicious process that is masquerading as the legitimate \"svchost.exe\" by naming its binary \"svchost.exe\" and executing from an uncommon location.\nAdversaries often disguise their malicious binaries by naming them after legitimate system processes like \"svchost.exe\" to evade detection.\n","author":"Swachchhanda Shrawan Poudel","status":"test","level":"high","date":"2024-08-07","modified":"","tags":["attack.stealth","attack.t1036.005"],"technique_ids":["T1036.005"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Unlikely"],"references":["https://tria.ge/240731-jh4crsycnb/behavioral2","https://redcanary.com/blog/threat-detection/process-masquerading/"],"source_path":"rules/windows/process_creation/proc_creation_win_svchost_masqueraded_execution.yml","source_sha256":"36d612d23e704493b68cf8c62423d152f7f2c89ddc7a39012ec327bd6063c8bd","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_svchost_masqueraded_execution.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Suspicious Process Masquerading As SvcHost.EXE\nid: be58d2e2-06c8-4f58-b666-b99f6dc3b6cd\nrelated:\n    - id: 01d2e2a1-5f09-44f7-9fc1-24faa7479b6d\n      type: similar\n    - id: e4a6b256-3e47-40fc-89d2-7a477edd6915\n      type: similar\nstatus: test\ndescription: |\n    Detects a suspicious process that is masquerading as the legitimate \"svchost.exe\" by naming its binary \"svchost.exe\" and executing from an uncommon location.\n    Adversaries often disguise their malicious binaries by naming them after legitimate system processes like \"svchost.exe\" to evade detection.\nreferences:\n    - https://tria.ge/240731-jh4crsycnb/behavioral2\n    - https://redcanary.com/blog/threat-detection/process-masquerading/\nauthor: Swachchhanda Shrawan Poudel\ndate: 2024-08-07\ntags:\n    - attack.stealth\n    - attack.t1036.005\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        Image|endswith: '\\svchost.exe'\n    filter_main_img_location:\n        Image:\n            - 'C:\\Windows\\System32\\svchost.exe'\n            - 'C:\\Windows\\SysWOW64\\svchost.exe'\n    filter_main_ofn:\n        OriginalFileName: 'svchost.exe'\n    condition: selection and not 1 of filter_main_*\nfalsepositives:\n    - Unlikely\nlevel: high\nregression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_svchost_masqueraded_execution/info.yml\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1036.005","id":"T1036.005","name":"Match Legitimate Resource Name or Location","page":"techniques/enterprise/T1036.005/"}],"data_path":"data/detection-rules/be58d2e2-06c8-4f58-b666-b99f6dc3b6cd.json","kind":"sigma"}