Suspicious Svchost Process Access

SigmaHQ Detections@sigmaHQ

•updated Apr 28, 2026•0•0•4

Detects suspicious access to the "svchost" process such as that used by Invoke-Phantom to kill the thread of the Windows event logging service.