csrss.exe

Client Server Runtime

A critical Windows process, started by the Session Manager, that once hosted the console.

Normal Profile

These are the values a genuine copy shows. Treat any value that differs as a lead.

Parent
smss.exe (a value that published detection rules check for)Source: Elastic: Unusual Parent-Child Relationship (opens in a new tab)That smss.exe copy exits, so live tools show no running parent, and Elastic's rule also accepts svchost.exe.
Path
System32 (a value that published detection rules check for)C:\Windows\System32\csrss.exeSources: SigmaHQ: System File Execution Location Anomaly (opens in a new tab), Velociraptor: Windows.Attack.UnexpectedImagePath (opens in a new tab)
Account
Read it from the token on a clean machine of the same build, with Get-Process -IncludeUserName live or windows.getsids in memory.
Session
Compare each copy's SessionId with the sessions open, using Get-CimInstance Win32_Process live or windows.pslist in memory.
Instances
Count copies and their sessions on a clean machine of the same build, and compare with the sessions open.
Starts
Compare with the start of its session, which is the last full boot for session 0 and the sign-in or connection for a person's.
Command Line
Read it elevated with Get-CimInstance Win32_Process, or windows.cmdline in memory, and compare with a clean machine of the same build.
Signed By
Check the file with Sigcheck or Get-AuthenticodeSignature, because many Windows files are signed through a catalogue, not in the file itself.

A value that published detection rules check for.No public source states this value, so compare with a clean machine of the same Windows build.

Why It Matters

Windows stops with bug check 0xEF, a blue screen, if it ends, so a genuine copy cannot be restarted. A copy that started long after its session began, or that runs outside System32, is not genuine, and its short name is easy to borrow, so check the folder and parent of every copy.

What It Does

csrss.exe is the Windows subsystem process, and every session has its own copy, one in session 0, where services run, and one in each person's session. A Session Manager copy starts it as each session is set up. csrss.exe is on Microsoft's list of critical processes, so if it ends, Windows stops with bug check 0xEF CRITICAL_PROCESS_DIED. It once hosted the console too. Microsoft split the console into client, driver and server parts between 2005 and 2009, because tying many programs to one critical, privileged process was dangerous. A copy outside System32, more copies than sessions, or one that started long after its session began is not genuine.

Elastic's rule expects smss.exe as its parent, and also accepts svchost.exe. It lets csrss.exe start only error reporting tools, conhost.exe and a few others, so a shell or a script under csrss.exe is out of place.

The Session Manager copy that started it exits, so live tools and windows.pstree show csrss.exe with no running parent. Creation records such as event 4688 in the Security log and Sysmon event 1 still name smss.exe. Windows reuses a process ID (PID) once its process exits, so a running process at csrss.exe's parent PID that started after csrss.exe is a later process with the same number, not its parent.

Volatility's windows.malware.psxview uses csrss.exe's handle table as one of its four views of the process list, so a process that csrss.exe holds but the active list lacks stands out.

How Attackers Abuse It

Each line is a way this process is misused, with the page that shows how to spot it.

  • Malware takes the short name csrss.exe and runs from a folder other than System32, among the copies every session has.Wrong Path
  • A name a letter away from csrss.exe runs beside the genuine copies, where a quick read of the list passes over it.Misspelt and Look-Alike Names

In the Process Tree

These are the rows of the process list that this page explains.

Red Flags

Each sign below links to the page that shows how to confirm it.

  • Any folder but System32, since the short name is easy to borrow.Wrong Path
  • A running parent that started before it, or a child beyond the error reporting tools, conhost.exe and a few others.Wrong Parent
  • A copy that started long after its session began, since a genuine one cannot restart without stopping Windows.Unusual Start Time
  • More copies than the machine has sessions open.Extra or Missing Instances
  • A name a letter away from csrss.exe, in any folder.Misspelt and Look-Alike Names

How to Check It

Each page shows how to check this process, on a running machine and in a memory image.

What Records It

Each record names its log and what must be switched on to get it.

Record and Where It LandsWhat to ReadHow to Turn It On
4688 A new process has been created (opens in a new tab)SecurityIt is written on the computer the process ran on.New Process Name csrss.exe with a Creator Process Name other than smss.exe, or a path outside System32.Process Trees and Call Chains shows how to read it.Turn on Audit Process Creation. For the command line, also turn on Include command line in process creation events.
1 Process creation (opens in a new tab)Microsoft-Windows-Sysmon/OperationalIt is written on any Windows computer running Sysmon.Image csrss.exe with a ParentImage other than smss.exe, or ParentImage csrss.exe on a child it never starts.Process Trees and Call Chains shows how to read it.Run Sysmon with ProcessCreate events in its configuration.
DeviceProcessEvents (opens in a new tab)Each row is a process creation or a related event, naming the new process, the process that created it and that creator's parent.Defender XDR, advanced huntingFileName csrss.exe with an InitiatingProcessFileName other than smss.exe, or a FolderPath outside System32.The Defender for Endpoint sensor on the device

Hunt It

The same hunt is written for four tools, so pick the one you use. Defender XDR and Sentinel queries are in KQL, which you paste into Advanced hunting in the Defender portal or into Sentinel's Logs page. Splunk queries are in SPL, for its Search page, and Velociraptor queries are in VQL, which you run as a hunt.

Sees It DirectlyDeviceProcessEvents, with DeviceFileCertificateInfo (documentation, opens in a new tab)

Reads the DeviceProcessEvents table in Defender XDR advanced hunting, from devices onboarded to Defender for Endpoint, so it holds only copies started while the sensor ran. Check that a recent boot shows the genuine copy before you read no rows as clean. A hit is a lead until its file and creator are checked. A blank signature means unknown, not unsigned, because DeviceFileCertificateInfo holds only files the sensor has checked.

KQLDefender XDR, Advanced hunting
// csrss.exe copies whose creator, path or signature breaks its profileDeviceProcessEvents| where Timestamp > ago(30d)| where FileName =~ "csrss.exe"| join kind=leftouter (    DeviceFileCertificateInfo    | summarize arg_max(Timestamp, IsSigned, IsTrusted, Signer, SignatureType) by SHA1    ) on SHA1| where InitiatingProcessFileName !in~ ("smss.exe", "svchost.exe")    or FolderPath !in~ (@"C:\Windows\System32\csrss.exe", @"C:\Windows\System32")    or IsTrusted == false| project Timestamp, DeviceName, FolderPath, ProcessCommandLine, AccountName, CreatedProcessSessionId, InitiatingProcessFileName, IsSigned, IsTrusted, Signer, SignatureType| order by Timestamp desc

Sources