dllhost Spawned by Unusual Parent

Daniel Koifman@Koifsec

•updated Mar 31, 2026•8•0•50

This rule detects instances where 'dllhost.exe' is spawned by an unusual parent process. Typically, 'dllhost.exe' is spawned by 'svchost.exe' or 'services.exe'. The rule specifically looks for 'dllhost.exe' processes whose parent is neither 'svchost.exe' nor 'services.exe', indicating a potentially malicious or unexpected execution chain.