Suspicious Svchost Process Creation Without Command-Line Arguments
This rule detects the highly unusual activity of 'svchost.exe' being spawned without any command-line arguments. This behavior is often indicative of a malicious process injecting code into the 'svchost.exe' memory space, leveraging a legitimate system process to evade detection. The rule specifically filters out known legitimate instances where 'svchost.exe' might appear without arguments, such as when spawned by 'rpcnet.exe' or 'rpcnetp.exe'.
Sigma
