Suspicious Svchost Process Access for Defense Evasion
Detects suspicious access to the "svchost" process with a high level of granted access (0x1F3FFF) and an unknown call trace. This behavior is often associated with techniques like those used by Invoke-Phantom to terminate critical system processes, such as the Windows event logging service, to evade detection. The rule filters out legitimate MSBuild activity that might exhibit similar call trace characteristics.
Sigma
