Uncommon Svchost Parent Process
This rule detects instances where 'svchost.exe' is spawned by an uncommon parent process. It specifically filters out common and legitimate parent processes such as 'Mrt.exe', 'MsMpEng.exe', 'ngen.exe', 'rpcnet.exe', 'services.exe', and 'TiWorker.exe', as well as cases where the parent process is null or empty. This helps to identify potential masquerading or defense evasion attempts where an adversary might try to hide malicious activity by naming their process 'svchost.exe' and having it spawned by an unusual parent.
Sigma
