fontdrvhost.exe

User Mode Font Driver Host

Expected under wininit.exe or winlogon.exe. Microsoft Learn has no page on it.

Normal Processes
Open it in the tree

Normal Profile

These are the values a genuine copy shows. Treat any value that differs as a lead.

Parent: wininit.exe or winlogon.exe (a value that published detection rules check for)Source: Elastic: Unusual Parent-Child Relationship (opens in a new tab)Elastic's rule also allows dwm.exe.
Path: Read it on a clean machine of the same build, because neither SigmaHQ's nor Velociraptor's path table lists it.
Account: Read it from each copy's token on a clean machine of the same build, with Process Explorer live or windows.getsids in memory.
Session: Read each copy's SessionId with Get-CimInstance Win32_Process or windows.pslist on a clean machine of the same build.
Instances: Count copies per session on a clean machine of the same build, before and after a second sign-in.
Starts: Compare each copy's start with its parent's on a clean machine of the same build.
Command Line: Read it elevated with Get-CimInstance Win32_Process on a clean machine of the same build.
Signed By: Check the file with Sigcheck, which reads catalogue signatures too, on a clean machine of the same build.

A value that published detection rules check for.No public source states this value, so compare with a clean machine of the same Windows build.

Why It Matters

Thinly documented processes are easy names to borrow. Elastic's parent rule is the public check that covers it, and it expects wininit.exe or winlogon.exe to start it.

What It Does

Microsoft Learn has no page for fontdrvhost.exe, so its profile rests on a detection rule. Elastic's Unusual Parent-Child Relationship rule expects wininit.exe or winlogon.exe to start it, also allows dwm.exe, and flags any other parent. Judge each copy by what you can check, its parent and its signature, against a clean machine of the same build. A copy under any other parent, or with no valid signature, is the one to look at.

The tree shows one copy under wininit.exe and one under winlogon.exe. Read the session, account and path of each on a clean machine of the same build before judging a copy. Its path is in neither SigmaHQ's nor Velociraptor's table of system file locations, so a wrong-path hunt needs your own baseline.

How Attackers Abuse It

Each line is a way this process is misused, with the page that shows how to spot it.

Malware takes the name fontdrvhost.exe and starts under a parent Elastic's rule does not accept.Wrong Parent
A file named fontdrvhost.exe with no valid signature, embedded or through a catalogue, is not the Windows copy.Renamed, Unsigned or Falsely Signed Binaries

In the Process Tree

These are the rows of the process list that this page explains.

fontdrvhost.exeFont Driver Host, session 0Open it in the tree: fontdrvhost.exe
fontdrvhost.exeFont Driver Host, the person's sessionOpen it in the tree: fontdrvhost.exe

Red Flags

Each sign below links to the page that shows how to confirm it.

A creator other than wininit.exe or winlogon.exe, though Elastic's rule also allows dwm.exe.Wrong Parent
More copies per session than a clean machine of the same build shows.Extra or Missing Instances
A fontdrvhost.exe with no valid signature, embedded or through a catalogue.Renamed, Unsigned or Falsely Signed Binaries

How to Check It

Each page shows how to check this process, on a running machine and in a memory image.

What Records It

Each record names its log and what must be switched on to get it.

Record and Where It Lands	What to Read	How to Turn It On
4688 `A new process has been created` (opens in a new tab)`Security`It is written on the computer the process ran on.	For a New Process Name ending in fontdrvhost.exe, the Creator Process Name should be wininit.exe or winlogon.exe.Process Trees and Call Chains shows how to read it.	Turn on Audit Process Creation. For the command line, also turn on Include command line in process creation events.
1 `Process creation` (opens in a new tab)`Microsoft-Windows-Sysmon/Operational`It is written on any Windows computer running Sysmon.	Image, ParentImage and User for each copy.Process Trees and Call Chains shows how to read it.	Run Sysmon with ProcessCreate events in its configuration.
`DeviceProcessEvents` (opens in a new tab)Each row is a process creation or a related event, naming the new process, the process that created it and that creator's parent.Defender XDR, advanced hunting	FolderPath, InitiatingProcessFileName and AccountName for each copy, to stack across machines.	The Defender for Endpoint sensor on the device

Hunt It

The same hunt is written for four tools, so pick the one you use. Defender XDR and Sentinel queries are in KQL, which you paste into Advanced hunting in the Defender portal or into Sentinel's Logs page. Splunk queries are in SPL, for its Search page, and Velociraptor queries are in VQL, which you run as a hunt.

Sees It DirectlyDeviceProcessEvents

Reads the DeviceProcessEvents table in Defender XDR advanced hunting, from devices onboarded to Defender for Endpoint. Rare rows are leads, not proof, so compare them with a clean machine of the same build.

KQLDefender XDR, Advanced hunting

// fontdrvhost.exe by creator, folder and account, rarest first: Elastic expects wininit.exe or winlogon.exeDeviceProcessEvents| where Timestamp > ago(30d)| where FileName =~ "fontdrvhost.exe"| summarize Copies = count(), Devices = dcount(DeviceName), LastSeen = max(Timestamp) by InitiatingProcessFileName, FolderPath, AccountName| order by Copies asc