Svchost.exe loads a rare unsigned module

Cortex XDR Analytics Alert Reference by Alert name

Product

Cortex XDR

Last date published

2024-09-24

Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	Requires: XDR Agent
Detection Modules
Detector Tags	Malicious Service Analytics
ATT&CK Tactic	Defense Evasion (TA0005) Persistence (TA0003)
ATT&CK Technique	Masquerading: Masquerade Task or Service (T1036.004) Create or Modify System Process: Windows Service (T1543.003)
Severity	Low

Svchost.exe loads a rare unsigned module, which can indicate an attacker's malicious service execution.

Evading detections by running code from a signed Microsoft executable.

Check whether the loaded module with the corresponding hash is benign, and if this was a desired behavior as part of its normal execution flow.
Go to the 'Services' registry key and investigate its sub keys to find the service associated with the loaded dll.