Dllhost.EXE Execution Anomaly

calendar Oct 23, 2025 · attack.privilege-escalation attack.defense-evasion attack.t1055  ·
Share on: linkedin copy

Detects a "dllhost" process spawning with no commandline arguments which is very rare to happen and could indicate process injection activity or malware mimicking similar system processes.

Sigma rule (View on GitHub)

 1title: Dllhost.EXE Execution Anomaly
 2id: e7888eb1-13b0-4616-bd99-4bc0c2b054b9
 3status: test
 4description: Detects a "dllhost" process spawning with no commandline arguments which is very rare to happen and could indicate process injection activity or malware mimicking similar system processes.
 5references:
 6    - https://redcanary.com/blog/child-processes/
 7    - https://nasbench.medium.com/what-is-the-dllhost-exe-process-actually-running-ef9fe4c19c08
 8    - https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/goofy-guineapig/NCSC-MAR-Goofy-Guineapig.pdf
 9author: Nasreddine Bencherchali (Nextron Systems)
10date: 2022-06-27
11modified: 2023-05-15
12tags:
13    - attack.privilege-escalation
14    - attack.defense-evasion
15    - attack.t1055
16logsource:
17    category: process_creation
18    product: windows
19detection:
20    selection:
21        Image|endswith: '\dllhost.exe'
22        CommandLine:
23            - 'dllhost.exe'
24            - 'dllhost'
25    filter_main_null:
26        CommandLine: null
27    condition: selection and not 1 of filter_main_*
28falsepositives:
29    - Unlikely
30level: high

References

Related rules

to-top