Rule Info
Name
Suspicious Process Masquerading As SvcHost.EXE
Author
Swachchhanda Shrawan Poudel
Description
Detects a suspicious process that is masquerading as the legitimate "svchost.exe" by naming its binary "svchost.exe" and executing from an uncommon location.
Adversaries often disguise their malicious binaries by naming them after legitimate system processes like "svchost.exe" to evade detection.
Date
2024-08-07 00:00:00
Modified
None
Id
be58d2e2-06c8-4f58-b666-b99f6dc3b6cd
Tags
attack.defense-evasion attack.t1036.005 DEMO
Type
Community Rule
Link to Public Repo
Scan your endpoints, forensic images or collected files with our portable scanner THOR