SecurityHealthHost.exe
by Microsoft
Endpoint Security
Summary
Windows Security Health Host - hosts the Windows Security application interface.
SecurityHealthHost.exe is the 802nd most commonly executed Windows program in EchoTrail's dataset, observed 3,922 times across enterprise environments. It typically runs from C:\Windows\System32 and it is most often launched by svchost.exe.
802nd
most commonly executed Windows program
3,922
observed executions
low
statistical confidence
Behavior
Top Paths
- C:\Windows\System3256.91%
- C:\Windows\System32\SecurityHealth\1.0.2303.27001-012.54%
- C:\Windows\System32\SecurityHealth\1.0.2303.28002-010.33%
- C:\Windows\System32\SecurityHealth\1.0.2306.10002-010.2%
- C:\Windows\System32\SecurityHealth\1.0.2302.21002-05.07%
- C:\Windows\System32\SecurityHealth\1.0.2207.20002-04.59%
- C:\Windows\System32\SecurityHealth\1.0.2209.22001-00.36%
Top Hashes (SHA256)
- 1d478b4af05c54f18ff5fa04fd524199cefc8c843b7e3dfd7c475a00a85ac00112.54%
- 660e8ce84f84d84475014985df1fda37e7fe926d2a5ea1199bef289cdf44176810.33%
- 8d771c8a91614b85416b3eb328460e80183b38f2dc35c7a26578206af145f41910.2%
- 4a56edeb0f1b6ede1d1b292dad034757da7f481435ae12c50482086d82a789048.39%
- 3f98c20df58d1dfc6ea01d42f890131ee5dc4efd0afedebb519036c5184c53905.56%
- 989f652848f7267aaf5b22f6d1ec1453377412f1fe21a78d05bf6617f6bb88725.35%
- 4ccc45215a9192472eb7e8c18efcd62b84ef444597c080ee49840e00bfb4b7dd5.07%
- 862de18d8c4f98c5b13f0be2a32cebf8a8926540a613974f3d494d20da94ea394.79%
- 4c8f93731166fbeec58d95ebee35b525b98dee1898ea91b17d8ec726d2b4d7704.59%
- 3f200e842f802400be4a86372a09de0e4e466e00ab03f04b28667eb4089c16534.23%
Process Ancestry
Top Parents
- svchost.exe99.92%
Rare or environment-specific process names are omitted from ancestry tables. Percentages are of all observed relationships.
Ask Rocky about SecurityHealthHost.exe
Rocky answers questions about SecurityHealthHost.exe grounded in this same dataset — free, no account needed.
Need this data programmatically? The Rocky API includes 500 free lookups a month. Or just ask Rocky.
Data from EchoTrail's dataset of ~346M Windows process executions. Last extracted 2026-08-04.