Windows Svchost Masquerading Suspicious Parent Spawn
Detects svchost.exe masquerading or abnormal process lineage. Legitimate svchost.exe runs from System32 or SysWOW64 and is launched by services.exe as the Service Control Manager host process. Execution from user-writable paths indicates binary masquerading; execution from script hosts or explorer indicates a rogue or attacker-controlled launch rather than normal service startup.
Sigma
