svchost.exe

Overview

SvcHost (Service Host) is a generic host process used by the Service Control Manager (services.exe) to load and run DLL-based services.

It should only run from:

Multiple instances of svchost.exe should be expected. Since Windows 10 version 1703, services are no longer grouped into shared host processes on systems with more than 3.5GB of memory. It is therefore normal to see significantly more svchost.exe instances on modern systems.

The -k flag specifies the service group and should always be present in the command line of a legitimate svchost.exe process.

The -s flag specifies a single service within the group.

The /P flag specifies service hardening policies and may indicate a legitimate service, although its presence should still be validated.

Expected Characteristics

Expected Location

Expected Parent

Typical Profile

Why This Matters

svchost.exe is one of the most commonly abused Windows processes because it provides a trusted method for launching services with elevated privileges.

Common adversary techniques include:

Investigation Objective

Determine whether svchost.exe is:

Particular attention should be paid to service creation, service modification, and process masquerading.

Normal Behaviour

Characteristics

Path

Digital Signature

Parent

Command Line

Typical format:

svchost.exe -k <service-group>

or

svchost.exe -k <service-group> -s <service>

or

svchost.exe -k <service-group> -s <service> /P

Children

Many svchost.exe instances are effectively childless.

Typical Activity

Expected Behavioural Characteristics

Abuse Patterns

Image Path Mismatch

Investigate immediately if svchost.exe is running from:

Examples include:

C:\Users\<user>\svchost.exe

C:\Temp\svchost.exe

C:\Windows\System32\srv\svchost.exe

These are strong indicators of masquerading.

Parent Process Mismatch

Investigate svchost.exe launched by:

powershell.exe

cmd.exe

mshta.exe

wscript.exe

wmiprvse.exe

Anything other than services.exe requires investigation.

Missing -k Flag

A legitimate svchost.exe instance should specify a service group.

Example:

svchost.exe -k netsvcs

Investigate instances lacking a -k parameter.

In most environments, the absence of a valid service group is a strong masquerading indicator.

Unexpected Child Processes

Examples include:

rundll32.exe

powershell.exe

cmd.exe

wscript.exe

cscript.exe

mshta.exe

Although there are exceptions, these remain high-value indicators.

Potential explanations include:

Service Abuse Indicators

Investigate:

Particularly relevant to:

Detection Opportunities

Process Lineage Analytics

Investigate:

Process lineage remains one of the highest-confidence indicators available.

Command-Line Analytics

Monitor for:

Useful examples include:

svchost.exe

without any additional parameters.

Service Creation Monitoring

Review:

A newly-created service is often more significant than the resulting svchost.exe process.

Child Process Monitoring

Investigate:

originating from svchost.exe.

Registry Monitoring

Relevant locations include:

HKLM\Software\Microsoft\Windows NT\CurrentVersion\SvcHost

and

HKLM\System\CurrentControlSet\Services

Unexpected changes may indicate service abuse or persistence activity.

Hunting Opportunities

Useful hunting pivots include:

Prioritise rarity and environmental context over static indicators.

False Positives

Missing Command Line Visibility

There are rare cases where svchost.exe runs with Protected Process Light (PPL).

In these situations:

The process may still be completely legitimate.

Parent Process Exceptions

services.exe should almost always be the parent process.

However:

This is uncommon but not inherently suspicious.

Legitimate Child Processes

Although unusual, some services may launch supporting binaries.

Examples include:

Validation should focus on:

Validation Questions

Check:

Compare with known-good systems whenever possible.

Hardening Recommendations

Service Governance

Maintain an inventory of:

Unknown services should be investigated promptly.

Application Control

Implement:

Prevent unauthorised binaries from executing as services.

Service Installation Monitoring

Alert on:

These events are often higher-fidelity than process alerts.

Restrict Administrative Access

Limit the ability to:

Reducing service creation opportunities significantly limits abuse.

Service Binary Validation

Regularly review:

Pay particular attention to services executing from user-writable locations.

Defensive Validation

Periodically test:

Validate controls against realistic persistence scenarios rather than isolated proof-of-concept activity.

Triage Checklist

Identity and Integrity Checks

Lineage and Behaviour Checks

Service Context Checks

Review:

HKLM\Software\Microsoft\Windows NT\CurrentVersion\SvcHost

and

HKLM\System\CurrentControlSet\Services

Validate:

Scope and Context

ATT&CK References

Windows Processes

Windows Services

MITRE ATT&CK

Updated: