svchost.exe

Top Paths

• C:\Windows\System32100%
• C:\Windows\SysWOW64<0.01%
• C:\Users\...<0.01%
• C:\Windows\Temp\...<0.01%
• C:\...<0.01%

Top Hashes (SHA256)

• b868487f8edbd0571d30d89573f087bfeac3da190652344afd351b1868ea0f8b21.6%
• 643ec58e82e0272c97c2a59f6020970d881af19c0ad5029db9c958c13b6558c717.75%
• dd191a5b23df92e12a8852291f9fb5ed594b76a28a5a464418442584afd1e04814.09%
• 9f21e51442209bcec0ea4a468ef8a4741685ae204d5063f4c3e45e1f8cf726438.01%
• 31780ff2aaf7bc71f755ba0e4fef1d61b060d1d2741eafb33cbab44d889595a05.89%
• 2b105fb153b1bcd619b95028612b3a93c60b953eef6837d3bb0099e4207aaf6b5.41%
• 7fd065bac18c5278777ae44908101cdfed72d26fa741367f0ad4d02020787ab64.71%
• add683a6910abbbf0e28b557fad0ba998166394932ae2aca069d9aa19ea8fe884.67%
• e3d84df77b279ea288cc726cbf68867dc6ae00d24e0e24985141a2ee4753682a4.33%
• c9a28dc8004c3e043cbf8e3a194fda2b756ce90740df2175488337281b485f693.1%

Top Grandparents

• wininit.exe99.89%
• services.exe0.11%
• explorer.exe<0.01%
• cmd.exe<0.01%
• userinit.exe<0.01%
• svchost.exe<0.01%

Top Parents

• services.exe99.66%
• MsMpEng.exe0.34%
• rpcnet.exe<0.01%
• svchost.exe<0.01%
• MRT.exe<0.01%
• cmd.exe<0.01%
• consent.exe<0.01%
• explorer.exe<0.01%
• python.exe<0.01%
• MRT-KB890830.exe<0.01%

Top Children

• WmiPrvSE.exe23.69%
• backgroundTaskHost.exe11.94%
• RuntimeBroker.exe7.02%
• taskhostw.exe6.28%
• dllhost.exe4.15%
• wermgr.exe2.87%
• GoogleUpdate.exe2.54%
• spatialaudiolicensesrv.exe2.27%
• filecoauth.exe2.14%
• TiWorker.exe2.08%

What does svchost.exe normally do?

Multiple instances running simultaneously, all launched by services.exe. Runs as SYSTEM, LOCAL SERVICE, or NETWORK SERVICE. Located exclusively in C:\Windows\System32 (64-bit) or C:\Windows\SysWOW64 (32-bit). Starts at boot time. Common children include WmiPrvSE.exe, backgroundTaskHost.exe, taskhostw.exe, and RuntimeBroker.exe.

When is svchost.exe suspicious?

Running from any directory other than System32 or SysWOW64. Parent process is anything other than services.exe. Name is slightly misspelled (svch0st, scvhost, svchost32, svchosts). Running under a standard user account. Making direct outbound network connections to unusual destinations. Spawning shells (cmd.exe, powershell.exe) or reconnaissance tools directly.

How do attackers abuse svchost.exe?

Name masquerading: malware uses similar filenames (svch0st.exe, scvhost.exe, svchost32.exe) to blend in. More common in commodity malware. Path masquerading: legitimate filename placed in an attacker-controlled directory. More common in targeted attacks. Process injection/migration: attackers inject code into a legitimate running svchost instance to inherit its elevated privileges and trusted status. Typically occurs after initial access is gained via a RAT. Service creation: attackers install malicious services that run under svchost to achieve persistence.

Detection guidance

High-confidence detections: (1) svchost.exe running from any path other than System32 or SysWOW64. (2) svchost.exe with a parent other than services.exe. (3) Fuzzy name matching for near-miss misspellings. Medium-confidence: svchost.exe spawning shells or reconnaissance tools. Use Sysmon Event ID 1 (Process Create) with ParentImage and Image path fields. For injection, monitor for Sysmon Event ID 8 (CreateRemoteThread) targeting svchost.

False positive notes

Multiple instances are normal — do not alert on instance count. MsMpEng.exe (Windows Defender) occasionally appears as a parent in some telemetry due to scanning behavior. WMI provider activity through svchost can generate high volumes of child processes.

MITRE ATT&CK techniques