Potential Exploitation Attempt Of Undocumented Windows Server RCE
Detects potential exploitation attempts of an undocumented Windows Server pre-authentication Remote Code Execution (RCE) vulnerability. The rule specifically looks for a new 'svchost.exe' process being created by another 'svchost.exe' process, both running with the '-k DHCPServer' command line argument, and under a Network Service account (covering multiple language settings). This pattern indicates an unusual execution flow that could be indicative of an RCE exploit targeting the DHCP Server service.
Sigma
