Uncommon Svchost Command Line Parameter (f17211f1-1f24-4d0c-829f-31e28dc93cdd)

Detects instances of svchost.exe running with an unusual or uncommon command line parameter by excluding known legitimate or common patterns. This could point at a file masquerading as svchost, a process injection, or hollowing of a legitimate svchost instance.

Cluster A	Galaxy A	Cluster B	Galaxy B	Level
Uncommon Svchost Command Line Parameter (f17211f1-1f24-4d0c-829f-31e28dc93cdd)	Sigma-Rules	Match Legitimate Resource Name or Location - T1036.005 (1c4e5d32-1fe9-4116-9d9d-59e3925bd6a2)	Attack Pattern	1
Uncommon Svchost Command Line Parameter (f17211f1-1f24-4d0c-829f-31e28dc93cdd)	Sigma-Rules	Process Injection - T1055 (43e7dc91-05b2-474c-b9ac-2ed4fe101f4d)	Attack Pattern	1
Uncommon Svchost Command Line Parameter (f17211f1-1f24-4d0c-829f-31e28dc93cdd)	Sigma-Rules	Process Hollowing - T1055.012 (b200542e-e877-4395-875b-cf1a44537ca4)	Attack Pattern	1
Match Legitimate Resource Name or Location - T1036.005 (1c4e5d32-1fe9-4116-9d9d-59e3925bd6a2)	Attack Pattern	Masquerading - T1036 (42e8de7b-37b2-4258-905a-6897815e58e0)	Attack Pattern	2
Process Injection - T1055 (43e7dc91-05b2-474c-b9ac-2ed4fe101f4d)	Attack Pattern	Process Hollowing - T1055.012 (b200542e-e877-4395-875b-cf1a44537ca4)	Attack Pattern	2