Query: rule covering Detects instances of svchost.exe running with an unusual or uncommon command line parameter by excluding known legitimat
Matching passage: Sigma rule: Detects instances of svchost.exe running with an unusual or uncommon command line parameter by excluding known legitimat. Logsource: windows / process_creation. Rule: title: Uncommon Svchost Command Line Parameter id: f17211f1-1f24-4d0c-829f-31e28dc93cdd status: experimental description: 'Detects instances of svchost.exe running with an unusual or uncommon command line parameter by excluding known legitimate or common patterns. This could point at a file masquerading as svchost, a process injection, or hollowing of a legitimate svchost instance. ' references: - https://cardinalops.com/blog/the-art-of-anomaly-hunting-patterns-detection/ - https://www.security.com/threat-intelligence/blackbyte-exbyte-ransomware - https://cloud.google.com/blog/topics/threat-intelligence/apt41-initiates-global-intrusion-campaign-using-multiple-exploits/ - https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/08064518/Carbanak_APT_eng.pdf author: Liran Ravich date: 2025-11-14 modified: 2026-03-23 tags: - attack.privilege-escalation - attack.stealth - attack.t1036.005 - attack.t1055 - attack.t1055.012 logsource: category: process_creation product: windows detection: selection: Image|endswith: \svchost.exe filter_main_flags: CommandLine|re: -k\s\w{1,64}(?:\s?(?:-p|-s))? filter_main_empty: CommandLine: '' filter_main_null: CommandLine: null filter_optional_defender: ParentImage|endswith: \MsMpEng.exe CommandLine|contains: svchost.exe filter_optional_mrt: ParentImage|endswith: \MRT.exe CommandLine: svchost.exe condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects a copy command or a copy utility execution to or from an Admin share or remote. Logsource: windows / process_creation. Rule: title: Copy From Or To Admin Share Or Sysvol Folder id: 855bc8b5-2ae8-402e-a9ed-b889e6df1900 status: test description: Detects a copy command or a copy utility execution to or from an Admin share or remote references: - https://twitter.com/SBousseaden/status/1211636381086339073 - https://drive.google.com/file/d/1lKya3_mLnR3UQuCoiYruO3qgu052_iS_/view - https://www.elastic.co/guide/en/security/current/remote-file-copy-to-a-hidden-share.html - https://www.microsoft.com/en-us/security/blog/2022/10/18/defenders-beware-a-case-for-post-ransomware-investigations/ author: Florian Roth (Nextron Systems), oscd.community, Teymur Kheirkhabarov @HeirhabarovT, Zach Stanford @svch0st, Nasreddine Bencherchali date: 2019-12-30 modified: 2025-10-22 tags: - attack.lateral-movement - attack.collection - attack.exfiltration - attack.t1039 - attack.t1048 - attack.t1021.002 logsource: category: process_creation product: windows detection: selection_target: CommandLine|contains: - \\\\*\\*$ - \Sysvol\ selection_other_tools: - Image|endswith: - \robocopy.exe - \xcopy.exe - OriginalFileName: - robocopy.exe - XCOPY.EXE selection_cmd_img: - Image|endswith: \cmd.exe - OriginalFileName: Cmd.Exe selection_cmd_cli: CommandLine|contains: copy selection_pwsh_img: - Image|contains: - \powershell_ise.exe - \powershell.exe - \pwsh.exe - OriginalFileName: - powershell_ise.exe - PowerShell.EXE - pwsh.dll selection_pwsh_cli: CommandLine|contains: - copy-item - 'copy ' - 'cpi ' - ' cp ' - 'move ' - ' move-item' - ' mi ' - ' mv ' condition: selection_target and (selection_other_tools or all of selection_cmd_* or all of selection_pwsh_*) falsepositives: - Administrative scripts level: medium