|
| 1 | +[metadata] |
| 2 | +creation_date = "2025/11/12" |
| 3 | +integration = ["windows"] |
| 4 | +maturity = "production" |
| 5 | +updated_date = "2025/11/12" |
| 6 | +min_stack_version = "9.1.0" |
| 7 | +min_stack_comments = "The esql match operator was introduced in version 9.1.0" |
| 8 | + |
| 9 | + |
| 10 | +[rule] |
| 11 | +author = ["Elastic"] |
| 12 | +description = """ |
| 13 | +Identifies attempts to masquerade as the Service Host process `svchost.exe` to evade detection and blend in with normal system activity. |
| 14 | +""" |
| 15 | +from = "now-9m" |
| 16 | +interval = "8m" |
| 17 | +language = "esql" |
| 18 | +license = "Elastic License v2" |
| 19 | +name = "Potential Masquerading as Svchost" |
| 20 | +note = """ ## Triage and analysis |
| 21 | +
|
| 22 | +> **Disclaimer**: |
| 23 | +> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs. |
| 24 | +
|
| 25 | +### Investigating Potential Masquerading as Svchost |
| 26 | +
|
| 27 | +svchost.exe is a legitimate Windows system process responsible for hosting multiple Windows services. Adversaries may attempt to masquerade as svchost.exe to evade detection and blend in with normal system activity. This is often achieved by renaming a malicious executable to svchost.exe, placing it outside of standard Windows directories or running it with unusual parent processes or command-line arguments. |
| 28 | +
|
| 29 | +### Possible investigation steps |
| 30 | +
|
| 31 | +- Review the process.executable and process.parent.executable fields to confirm the location and unexpected parents.. |
| 32 | +- Check the process.command_line field for unusual arguments. Legitimate svchost.exe instances typically use the -k parameter followed by a valid service group name. |
| 33 | +- Investigate the process.code_signature field to determine if the binary is signed by Microsoft. Unsigned or invalid signatures are strong indicators of masquerading. |
| 34 | +- Correlate the event with other telemetry from the same host to identify additional indicators such as file creation, network connections, or registry modifications related to the suspicious process. |
| 35 | +- Review related file creation events to determine how and when the fake svchost.exe was introduced to the system (e.g. dropped by another malware component or downloaded from the network). |
| 36 | +
|
| 37 | +### False positive analysis |
| 38 | +
|
| 39 | +- Some legitimate third-party applications may use executables named svchost.exe within their own installation paths. Verify the vendor, file hash, and digital signature to determine legitimacy. |
| 40 | +- In virtualized or sandboxed environments, custom service hosts may appear with similar naming conventions. Validate these against known baseline configurations. |
| 41 | +- Ensure that system recovery or diagnostic tools using temporary binaries are not misidentified as malicious. Review event timing and system logs to confirm. |
| 42 | +- Regularly maintain an inventory of known legitimate `svchost.exe` locations and hashes to minimize false positives across managed hosts. |
| 43 | +
|
| 44 | +### Response and remediation |
| 45 | +
|
| 46 | +- Isolate the affected host immediately to prevent lateral movement or further compromise. |
| 47 | +- Terminate any suspicious svchost.exe processes executing from non-standard locations. |
| 48 | +- Quarantine and remove the rogue binary after verification through hash reputation or sandbox analysis. |
| 49 | +- Perform a full system scan to identify additional malicious files or persistence mechanisms associated with the masqueraded process. |
| 50 | +- Review and reset any credentials used by the compromised process if credential theft or impersonation is suspected. |
| 51 | +- Analyze recent network activity from the affected host for potential data exfiltration or commandand-control communication. |
| 52 | +- Escalate the incident to the security operations or incident response team for deeper investigation and forensic analysis. |
| 53 | +- Implement detections to monitor for future attempts of process masquerading, and update security baselines and EDR exclusions accordingly. |
| 54 | +""" |
| 55 | +risk_score = 73 |
| 56 | +rule_id = "32f95776-6498-4f3c-a90c-d4f6083e3901" |
| 57 | +severity = "high" |
| 58 | +tags = [ |
| 59 | + "Domain: Endpoint", |
| 60 | + "OS: Windows", |
| 61 | + "Use Case: Threat Detection", |
| 62 | + "Tactic: Defense Evasion", |
| 63 | + "Resources: Investigation Guide" |
| 64 | +] |
| 65 | +timestamp_override = "event.ingested" |
| 66 | +type = "esql" |
| 67 | + |
| 68 | +query = ''' |
| 69 | +FROM logs-* metadata _id, _version, _index |
| 70 | +| where event.category == "process" and event.type == "start" and |
| 71 | + match(process.name, "svchost.exe", { "fuzziness": 1, "max_expansions": 10 }) and |
| 72 | + not process.executable in ("C:\\Windows\\SysWOW64\\svchost.exe", "C:\\Windows\\System32\\svchost.exe") and |
| 73 | + not process.executable like """\\Device\\HarddiskVolume*\\Windows\\System32\\svchost.exe""" and |
| 74 | + not process.executable like """\\Device\\HarddiskVolume*\\Windows\\SysWOW64\\svchost.exe""" |
| 75 | +| keep event.dataset, host.name, host.id, user.id, user.name, process.executable, process.parent.executable, process.command_line |
| 76 | +''' |
| 77 | + |
| 78 | + |
| 79 | +[[rule.threat]] |
| 80 | +framework = "MITRE ATT&CK" |
| 81 | +[[rule.threat.technique]] |
| 82 | +id = "T1036" |
| 83 | +name = "Masquerading" |
| 84 | +reference = "https://attack.mitre.org/techniques/T1036/" |
| 85 | +[[rule.threat.technique.subtechnique]] |
| 86 | +id = "T1036.005" |
| 87 | +name = "Match Legitimate Resource Name or Location" |
| 88 | +reference = "https://attack.mitre.org/techniques/T1036/005/" |
| 89 | + |
| 90 | + |
| 91 | + |
| 92 | +[rule.threat.tactic] |
| 93 | +id = "TA0005" |
| 94 | +name = "Defense Evasion" |
| 95 | +reference = "https://attack.mitre.org/tactics/TA0005/" |
| 96 | + |
0 commit comments