Skip to content
Threat Feed

Tag

Process_injection

2 briefs RSS
medium advisory

Unusual Service Host Child Process - Childless Service

This detection identifies unusual child processes of Service Host (svchost.exe) that traditionally do not spawn child processes, potentially indicating code injection or exploitation.

m365_defender +3 process_injection privilege_escalation defense_evasion windows
2r 2t
medium advisory

Suspicious Svchost.exe Child Process: cmd.exe

Detection of cmd.exe being spawned by svchost.exe, which is an unusual behavior indicative of potential masquerading or privilege escalation attempts on Windows systems.

execution windows process_injection privilege_escalation
2r 2t