Svchost.exe loads a rare unsigned module
Synopsis
Activation Period
14 Days
Training Period
30 Days
Test Period
N/A (single event)
Deduplication Period
1 Day
Required Data
XDR Agent
Detector Tags
Malicious Service Analytics
ATT&CK Tactic
Stealth (TA0005), Persistence (TA0003)
ATT&CK Technique
Masquerading: Masquerade Task or Service (T1036.004), Create or Modify System Process: Windows Service (T1543.003)
Severity
Low
Description
Svchost.exe loads a rare unsigned module, which can indicate an attacker's malicious service execution.
Attacker's Goals
Evading detections by running code from a signed Microsoft executable.
Investigative actions
Check whether the loaded module with the corresponding hash is benign and if this was a desired behavior as part of its normal execution flow.
Go to the 'Services' registry key and investigate its sub keys to find the service associated with the loaded dll.
Was this helpful?