Windows.System.SVCHost

Lists svchost.exe processes whose parent is not services.exe, indicating suspicious activity.

Typically a windows system will have many svchost.exe processes. Sometimes attackers name their processes svchost.exe to try to hide. Typically svchost.exe is spawned by services.exe.

This artifact lists all the processes named svchost.exe and their parents where the parent is NOT named services.exe.

name: Windows.System.SVCHost
description: |
  Lists `svchost.exe` processes whose parent is not services.exe,
  indicating suspicious activity.
  
  Typically a windows system will have many `svchost.exe`
  processes. Sometimes attackers name their processes `svchost.exe` to
  try to hide. Typically `svchost.exe` is spawned by `services.exe`.

  This artifact lists all the processes named `svchost.exe` and their
  parents where the parent is NOT named `services.exe`.

sources:
  - precondition: |
      SELECT OS From info() where OS = 'windows'

    query: |
        // Cache the pslist output in memory.
        LET processes <= SELECT Pid, Ppid, Name, Exe FROM pslist()

        // Get the pids of all procecesses named services.exe
        LET services <= SELECT Pid FROM processes where Name =~ "services.exe"

        // The interesting processes are those which are not spawned by services.exe
        LET suspicious = SELECT Pid As SVCHostPid,
            Ppid As SVCHostPpid,
            Exe as SVCHostExe,
            CommandLine as SVCHostCommandLine
        FROM processes
        WHERE Name =~ "svchost" AND NOT Ppid in services.Pid

        // Now for each such process we display its actual parent.
        SELECT * from foreach(
           row=suspicious,
           query={
              SELECT SVCHostPid, SVCHostPpid, SVCHostExe,
                     SVCHostCommandLine, Name as ParentName,
                     Exe As ParentExe
              FROM processes
              WHERE Pid=SVCHostPpid
          })