Suspicious Process Masquerading As SvcHost.EXE

Title: Suspicious Process Masquerading As SvcHost.EXE
Status: test
Description:Detects a suspicious process that is masquerading as the legitimate "svchost.exe" by naming its binary "svchost.exe" and executing from an uncommon location. Adversaries often disguise their malicious binaries by naming them after legitimate system processes like "svchost.exe" to evade detection.
References:
  -https://tria.ge/240731-jh4crsycnb/behavioral2
  -https://redcanary.com/blog/threat-detection/process-masquerading/
Author: Swachchhanda Shrawan Poudel
Date: 2024-08-07
modified:None
Tags:

• -'attack.stealth'
• -'attack.t1036.005'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection:
    Image|endswith: '\svchost.exe'
  filter_main_img_location:
    Image:
      -'C:\Windows\System32\svchost.exe'
      -'C:\Windows\SysWOW64\svchost.exe'

  filter_main_ofn:
    OriginalFileName: 'svchost.exe'
  condition:selection and not 1 of filter_main_*
Falsepositives:
  -Unlikely
Level: high