Sigma rule: Uncommon Svchost Command Line Parameter

Rule

Title

Uncommon Svchost Command Line Parameter

Status

experimental

Level

high

Author

Liran Ravich

Date

2025-11-14

Modified

2026-03-23

File

rules/windows/process_creation/proc_creation_win_svchost_uncommon_command_line_flags.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects instances of svchost.exe running with an unusual or uncommon command line parameter by excluding known legitimate or common patterns.
This could point at a file masquerading as svchost, a process injection, or hollowing of a legitimate svchost instance.

Log source

product

windows

category

process_creation

Detection

selection:
    # Example of command to simulate: "C:\Windows\System32\svchost.exe" calc.exe
    Image|endswith: '\svchost.exe'
filter_main_flags:
    CommandLine|re: '-k\s\w{1,64}(?:\s?(?:-p|-s))?'
filter_main_empty:
    CommandLine: ''
filter_main_null:
    CommandLine: null
filter_optional_defender:
    ParentImage|endswith: '\MsMpEng.exe'
    CommandLine|contains: 'svchost.exe'
filter_optional_mrt:
    ParentImage|endswith: '\MRT.exe'
    CommandLine: 'svchost.exe'
condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*

False positives (as the rule lists them)

• Unlikely

Tags

• attack.privilege-escalation
• attack.stealth
• attack.t1036.005
• attack.t1055
• attack.t1055.012

MITRE ATT&CK ids this rule names

• T1036.005
• T1055
• T1055.012

References

• https://cardinalops.com/blog/the-art-of-anomaly-hunting-patterns-detection/
• https://www.security.com/threat-intelligence/blackbyte-exbyte-ransomware
• https://cloud.google.com/blog/topics/threat-intelligence/apt41-initiates-global-intrusion-campaign-using-multiple-exploits/
• https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/08064518/Carbanak_APT_eng.pdf

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/process_creation/proc_creation_win_svchost_uncommon_command_line_flags.yml