Unusual Service Host Child Process - Childless Service

This detection rule identifies unusual child processes spawned by Service Host (svchost.exe) on Windows systems. Svchost.exe is a critical process that hosts various Windows services. Certain services running under svchost.exe are not expected to create child processes. Adversaries may inject malicious code into these svchost.exe instances to execute unauthorized processes while evading detection. This technique is often employed to gain elevated privileges or bypass security controls. The rule focuses on detecting deviations from normal behavior by monitoring child processes of these traditionally childless services. The identified services include WdiSystemHost, LicenseManager, StorSvc, CDPSvc, cdbhsvc, BthAvctpSvc, SstpSvc, WdiServiceHost, imgsvc, TrkWks, WpnService, IKEEXT, PolicyAgent, CryptSvc, netprofm, ProfSvc, StateRepository, camsvc, LanmanWorkstation, NlaSvc, EventLog, hidserv, DisplayEnhancementService, ShellHWDetection, AppHostSvc, fhsvc, CscService, and PushToInstall. This rule aims to detect T1055, specifically process hollowing (T1055.012).

Attack Chain

1. The attacker gains initial access to the system through various means (e.g., phishing, exploitation of a vulnerability).
2. The attacker injects malicious code into a running svchost.exe process. The targeted svchost.exe instance hosts a service known to be "childless," such as WdiSystemHost or StorSvc.
3. Process injection leverages techniques like process hollowing (T1055.012), where a legitimate process (svchost.exe) is replaced with malicious code.
4. The injected code spawns a new process (e.g., cmd.exe, powershell.exe) as a child of the compromised svchost.exe instance.
5. This newly created child process executes malicious commands or scripts, potentially leading to privilege escalation or lateral movement.
6. The attacker attempts to evade detection by hiding malicious activity within a legitimate system process (svchost.exe).
7. The attacker gains persistence through the injected code, allowing for continued access to the system.
8. The attacker achieves their final objective, such as data exfiltration, deployment of ransomware, or establishing a command and control channel.

Impact

A successful attack can lead to privilege escalation, allowing the attacker to gain control of the compromised system. This can result in data theft, system disruption, or the deployment of ransomware. The rule helps in identifying potentially malicious activities that abuse svchost.exe, reducing the risk of successful code injection attacks and limiting damage to the system and organization. Failure to detect this activity can result in complete system compromise.

Recommendation

• Deploy the provided Sigma rule to your SIEM to detect unusual child processes of svchost.exe instances hosting childless services. Tune the rule based on your environment to minimize false positives (rule: "Unusual Service Host Child Process").
• Investigate any alerts generated by the Sigma rule by examining the process details, parent process arguments, and network connections of the child process (rule: "Unusual Service Host Child Process").
• Review and update the exclusion list in the Sigma rule to account for legitimate processes that may occasionally be spawned by svchost.exe (rule: "Unusual Service Host Child Process").
• Enable process creation logging with command line arguments in Sysmon to provide detailed information for investigating potential process injection attacks (logsource: process_creation).
• Monitor network connections originating from svchost.exe processes and their child processes for suspicious outbound traffic (logsource: network_connection).