APT41 ToughProgress PLUSINJECT - Svchost Process Hollowing via Unexpected Parent

Ankit Mehta@Secvyn

•updated Jun 29, 2026•0•0•0

Detects instances of the svchost.exe process running from an unexpected parent process or with unusual command-line arguments. Legitimate svchost.exe instances are typically spawned by services.exe or wininit.exe and utilize specific command-line flags. This rule identifies potential masquerading attempts where malicious actors name a process svchost.exe to evade detection.