Dllhost.EXE Execution Anomaly

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•13

Detects an anomalous execution of 'dllhost.exe' where the process spawns without any command-line arguments. This behavior is highly unusual for legitimate 'dllhost.exe' processes and can indicate malicious activity such as process injection or malware attempting to masquerade as a legitimate system process.