Misspelt and Look-Alike Names

Red Flags

Malware can take a name one letter away from a Windows process, or write it with characters from another alphabet that look the same. Windows never misspells its own processes, so a name like scvhost.exe is never a version of the genuine program. A near miss on a busy name such as svchost.exe, which runs in many genuine copies, is easy to overlook in a long list. Compare each name with the core names letter by letter, then check its path and parent, which a borrowed name cannot fix.

Normal and Suspicious

A clean machine sits beside a suspicious one, and the pointer marks where to look.

Normal

A clean Windows 11 install

A service host on a clean install, spelt as Windows writes it and started by services.exe.
NameParentPath
services.exewininit.exeC:\Windows\System32\services.exe
svchost.exeservices.exeC:\Windows\System32\svchost.exe
See It in the Window

Suspicious

ws-042,

The misnamed service host on ws-042 at 10:07 on 12 Oct 2026.
NameParentPath
updsvc64.exeservices.exeC:\Windows\Temp\updsvc64.exe
scvhost.exeupdsvc64.exeC:\Windows\Temp\scvhost.exe
Namescvhost.exe, two letters swapped: the genuine service host is svchost.exe. Misspelt and Look-Alike Names
See It in the Window

Why It Matters

A near miss on a busy name such as svchost.exe passes a glance down a long list of processes. Malware borrows the names people expect to see.

How to Confirm It

Work through these in order. Each step names the page that shows how.

  1. Compare every name with the core names for one swapped, missing or extra letter, as Elastic's svchost.exe rule does with a fuzzy match.Process Listings and Scans
  2. Look for letters from other scripts, a right-to-left override character and a double extension, because a name can look right and still not be.Process Listings and Scans
  3. Check the path, the parent and the signer against the genuine program's. Each one that differs is a sign of its own.Process Listings and Scans
  4. Find what started it and when the file arrived, reading the parent chain, then Amcache and ShimCache for the file's first appearance.Process Trees and Call Chains

What Defenders See

Each record names its log and what must be switched on to get it.

Record and Where It LandsWhat to ReadHow to Turn It On
4688 A new process has been created (opens in a new tab)SecurityIt is written on the computer the process ran on.New Process Name holds the full path. Compare its file name with the core names, letter by letter, in a query rather than by eye.Process Trees and Call Chains shows how to read it.Turn on Audit Process Creation. For the command line, also turn on Include command line in process creation events.
1 Process creation (opens in a new tab)Microsoft-Windows-Sysmon/OperationalIt is written on any Windows computer running Sysmon.Image and OriginalFileName. A look-alike written from scratch has its own original name, or none.Process Trees and Call Chains shows how to read it.Run Sysmon with ProcessCreate events in its configuration.
DeviceProcessEvents (opens in a new tab)Each row is a process creation or a related event, naming the new process, the process that created it and that creator's parent.Defender XDR, advanced huntingFileName and FolderPath for every start, so near misses can be hunted across the estate.The Defender for Endpoint sensor on the device
11 FileCreate (opens in a new tab)Microsoft-Windows-Sysmon/OperationalIt is written on any Windows computer running Sysmon.FileCreate records when the look-alike file was written, and by which process.Run Sysmon with FileCreate events in its configuration.

What It Looks Like

This record is decoded field by field, with what each value means.

4688 A new process has been created (opens in a new tab)On ws-042, . Event 4688 in the Security log on ws-042 when scvhost.exe started.
Field, as the Record Writes ItWhat It Tells You
New Process NameC:\Windows\Temp\scvhost.exescvhost.exe, two letters swapped from svchost.exe, in the temporary folder. Both the name and the folder are wrong.
Creator Process NameC:\Windows\Temp\updsvc64.exeStarted by updsvc64.exe, the service binary in the same folder. A genuine service host is started by services.exe, not by a program in Temp.
False Positives

Kernel listings keep 14 characters of a name, so windows.pslist shows SecurityHealthSystray.exe as SecurityHealth. A cut name is not a misspelling, so read the full one from the path.

Other vendors' programs can sit close to a Windows name, so check the signer and the folder before calling one a look-alike.

Blind Spots

A near-miss check finds a swapped, missing or extra letter, not a new word, so a name built to sound like a service, such as updsvc64.exe, needs the path and signature checks.

Look-alike letters from other scripts render the same in most fonts, so read names as data in a query, never by eye.

Hunt It

The same hunt is written for four tools, so pick the one you use. Defender XDR and Sentinel queries are in KQL, which you paste into Advanced hunting in the Defender portal or into Sentinel's Logs page. Splunk queries are in SPL, for its Search page, and Velociraptor queries are in VQL, which you run as a hunt.

Sees It DirectlyDeviceProcessEvents (documentation, opens in a new tab)

Needs Defender for Endpoint. A hit is a name to explain, not proof, as some genuine programs fit a core name's letters. Elastic's fuzzy svchost.exe rule finds one-letter changes this letter test misses, so run both.

KQLDefender XDR, Advanced hunting
// Names built only from a core name's letters but not that name, names with non-ASCII characters, and double extensionsDeviceProcessEvents| where Timestamp > ago(30d)| extend Name = tolower(FileName)| where (Name matches regex @"^([svchot]{6,8}|[las]{4,6}|[csr]{4,6}|[sm]{3,5}|[servic]{7,9}|[wint]{6,8}|[winlog]{7,9}|[explor]{7,9}|[spolv]{6,8}|[conhst]{6,8}|[dlhost]{6,8}|[taskhow]{8,10})\.exe$"        and Name !in ("svchost.exe", "lsass.exe", "csrss.exe", "smss.exe", "services.exe", "wininit.exe", "winlogon.exe", "explorer.exe", "spoolsv.exe", "conhost.exe", "dllhost.exe", "taskhostw.exe"))    or FileName matches regex @"[^ -~]"    or Name matches regex @"\.(pdf|docx?|xlsx?|txt|jpe?g|png)\.exe$"| summarize Starts = count(), FirstSeen = min(Timestamp), LastSeen = max(Timestamp) by DeviceName, FileName, FolderPath, InitiatingProcessFileName| order by FirstSeen desc

In a Memory Image

Volatility 3 reads a memory image, and each of its plugins below shows part of this sign.

  • windows.pslist (documentation, opens in a new tab)Memory Image A Volatility 3 plugin. It is one check run on a saved copy of a Windows machine's memory. pslist means process list. The kernel's image name, cut to 14 characters, which is enough to spot a swap but not to read a long name in full.
  • windows.pstree (documentation, opens in a new tab)Memory Image A Volatility 3 plugin. It is one check run on a saved copy of a Windows machine's memory. pstree means process tree. The kernel's audit path for each process, which holds the full file name.
  • windows.cmdline (documentation, opens in a new tab)Memory Image A Volatility 3 plugin. It is one check run on a saved copy of a Windows machine's memory. cmdline means command line. The command line as the PEB holds it, which usually starts with the program's full path and name.

Rules to Compare With

Security vendors publish detection rules anyone can read. These look for the same thing, so compare your own with them.

Show the 3 Public Rules

How to Prevent It

Each control helps prevent it, and its line says what it does here.

Related

Where It Matters Most
  • csrss.exe A name a letter away from csrss.exe, in any folder.
  • svchost.exe A look-alike name, such as scvhost.exe with two letters swapped, which exact-name checks miss, so hunt look-alikes.
  • RuntimeBroker.exe A name a letter away from RuntimeBroker.exe, though a cut name in memory listings is normal.
Travels with
  • Wrong Path Check the folder of a look-alike name too, since scvhost.exe ran from C:\Windows\Temp, not System32.
Check It in the Registry
AmcacheShimCache (AppCompatCache)

Sources

MITRE ATT&CK is a free public catalogue of the techniques attackers use. Each technique has an ID, such as T1055 for Process Injection, so defenders can name the same behaviour the same way. This red flag can point to these techniques.