{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata — refreshed continuously.","feed_url":"https://feed.craftedsignal.io/products/m365_defender/","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cves":[],"_cs_exploited":false,"_cs_products":["m365_defender","Elastic Defend","SentinelOne Cloud Funnel","Sysmon"],"_cs_severities":["medium"],"_cs_tags":["process_injection","privilege_escalation","defense_evasion","windows"],"_cs_type":"advisory","_cs_vendors":["Microsoft","Elastic","SentinelOne"],"content_html":"\u003cp\u003eThe Windows Service Host process (svchost.exe) is a critical system component that hosts multiple Windows services to optimize resource utilization. Certain services running under svchost.exe are not expected to spawn child processes. Attackers may inject malicious code into these \u0026ldquo;childless\u0026rdquo; svchost processes to execute unauthorized commands and evade traditional detection methods. This detection rule identifies anomalies by monitoring child processes of svchost.exe instances associated with services known to be childless, such as \u003ccode\u003eWdiSystemHost\u003c/code\u003e, \u003ccode\u003eLicenseManager\u003c/code\u003e, and \u003ccode\u003eStorSvc\u003c/code\u003e, flagging potential process injection or exploitation attempts. The rule aims to identify deviations from the expected behavior of these services, providing an early warning of potential malicious activity.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker gains initial access to the system through an exploit or by leveraging existing credentials.\u003c/li\u003e\n\u003cli\u003eThe attacker injects malicious code into a running svchost.exe process associated with a childless service like \u003ccode\u003eWdiSystemHost\u003c/code\u003e or \u003ccode\u003eStorSvc\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe injected code spawns a child process from the targeted svchost.exe instance. This could involve executing a system utility or a custom payload.\u003c/li\u003e\n\u003cli\u003eThe child process executes commands or performs actions dictated by the injected code, such as establishing a reverse shell or downloading additional payloads.\u003c/li\u003e\n\u003cli\u003eThe attacker uses the spawned process to perform reconnaissance activities, gathering information about the system and network.\u003c/li\u003e\n\u003cli\u003eThe attacker escalates privileges, potentially leveraging vulnerabilities or misconfigurations accessible from the compromised svchost process.\u003c/li\u003e\n\u003cli\u003eThe attacker moves laterally to other systems on the network, using the compromised system as a pivot point.\u003c/li\u003e\n\u003cli\u003eThe attacker achieves their final objective, which may include data exfiltration, ransomware deployment, or establishing persistent access.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation can lead to privilege escalation, allowing attackers to gain control of the compromised system and potentially the entire network. Attackers can use the compromised system as a staging ground for further attacks, exfiltrate sensitive data, deploy ransomware, or disrupt critical services. The medium severity score reflects the potential for significant impact if the activity is not detected and contained promptly.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDeploy the Sigma rule \u003ccode\u003eUnusual Svchost Child Process - Childless Service\u003c/code\u003e to your SIEM to detect potential process injection attacks targeting svchost.exe.\u003c/li\u003e\n\u003cli\u003eTune the rule by adding known false positives to the exclusion list, such as \u003ccode\u003eWerFault.exe\u003c/code\u003e, \u003ccode\u003eWerFaultSecure.exe\u003c/code\u003e, and \u003ccode\u003ewermgr.exe\u003c/code\u003e to reduce alert fatigue.\u003c/li\u003e\n\u003cli\u003eEnable process creation logging via Sysmon (Event ID 1) with command line details for better visibility into spawned processes, as described in the \u003ca href=\"https://ela.st/sysmon-event-1-setup\"\u003esetup guide\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003eInvestigate any alerts generated by the rule, focusing on the process details and parent-child relationships to determine the legitimacy of the spawned process.\u003c/li\u003e\n\u003cli\u003eConsider using endpoint detection and response (EDR) solutions like Elastic Defend for enhanced visibility and automated response capabilities, as the rule is designed for data generated by \u003ca href=\"https://www.elastic.co/security/endpoint-security\"\u003eElastic Defend\u003c/a\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2024-01-04T12:00:00Z","date_published":"2024-01-04T12:00:00Z","id":"/briefs/2024-01-unusual-svchost-child-process/","summary":"This detection identifies unusual child processes of Service Host (svchost.exe) that traditionally do not spawn child processes, potentially indicating code injection or exploitation.","title":"Unusual Service Host Child Process - Childless Service","url":"https://feed.craftedsignal.io/briefs/2024-01-unusual-svchost-child-process/"}],"language":"en","title":"CraftedSignal Threat Feed — M365_defender","version":"https://jsonfeed.org/version/1.1"}