sihost.exe

Shell Infrastructure Host

Microsoft Learn has no page on it, and a SigmaHQ rule expects it in System32.

Normal Processes
Open it in the tree

Normal Profile

These are the values a genuine copy shows. Treat any value that differs as a lead.

Parent: Read it on a clean machine of the same build, where Get-CimInstance Win32_Process gives its parent's PID and tasklist /svc names that host's services.
Path: System32 (a value that published detection rules check for)C:\Windows\System32\sihost.exeSource: SigmaHQ: System File Execution Location Anomaly (opens in a new tab)
Account: Read it from the process token on a clean machine of the same build, with Process Explorer live or windows.getsids in memory.
Session: Read its SessionId with Get-CimInstance Win32_Process or windows.pslist on a clean machine of the same build.
Instances: Count copies per session on a clean machine of the same build, before and after a second sign-in.
Starts: Compare its start with the sign-in's on a clean machine of the same build.
Command Line: Read it elevated with Get-CimInstance Win32_Process on a clean machine of the same build.
Signed By: Check the file with Sigcheck, which reads catalogue signatures too, on a clean machine of the same build.

A value that published detection rules check for.No public source states this value, so compare with a clean machine of the same Windows build.

Why It Matters

Little is public about it, so check what you can, which is its folder, its signature and a parent that matches a clean machine of the same build.

What It Does

Microsoft Learn has no page for sihost.exe, and neither Elastic's nor Velociraptor's parent table lists it. SigmaHQ's System File Execution Location Anomaly rule expects it in System32, the one sourced value on this page. Elastic's parent spoofing rule leaves out msedge.exe whose recorded parent is sihost.exe, a known harmless case where the recorded parent differs from the process that created it. So msedge.exe recorded under it can be normal. A copy outside System32, or one with no valid signature, is the one to look at.

Read its parent, account and session on a clean machine of the same build before you judge a copy, and check its signature with a tool that reads catalogue signatures too.

How Attackers Abuse It

Each line is a way this process is misused, with the page that shows how to spot it.

Malware takes the name sihost.exe and runs from a user folder, where SigmaHQ's location rule catches it.Wrong Path
A file named sihost.exe with no valid signature, embedded or through a catalogue, is not the Windows copy.Renamed, Unsigned or Falsely Signed Binaries

Red Flags

Each sign below links to the page that shows how to confirm it.

Any folder but C:\Windows\System32.Wrong Path
A child recorded under it that it did not create, apart from msedge.exe, a harmless case Elastic excuses.Parent Process Spoofing
A sihost.exe with no valid signature, embedded or through a catalogue.Renamed, Unsigned or Falsely Signed Binaries

How to Check It

Each page shows how to check this process, on a running machine and in a memory image.

What Records It

Each record names its log and what must be switched on to get it.

Record and Where It Lands	What to Read	How to Turn It On
4688 `A new process has been created` (opens in a new tab)`Security`It is written on the computer the process ran on.	For a New Process Name ending in sihost.exe, its Creator Process Name, and a path in System32.Process Trees and Call Chains shows how to read it.	Turn on Audit Process Creation. For the command line, also turn on Include command line in process creation events.
1 `Process creation` (opens in a new tab)`Microsoft-Windows-Sysmon/Operational`It is written on any Windows computer running Sysmon.	Image, ParentImage and User for each copy.Process Trees and Call Chains shows how to read it.	Run Sysmon with ProcessCreate events in its configuration.
`DeviceProcessEvents` (opens in a new tab)Each row is a process creation or a related event, naming the new process, the process that created it and that creator's parent.Defender XDR, advanced hunting	FolderPath, InitiatingProcessFileName and AccountName for each copy, to stack across machines.	The Defender for Endpoint sensor on the device

Hunt It

The same hunt is written for four tools, so pick the one you use. Defender XDR and Sentinel queries are in KQL, which you paste into Advanced hunting in the Defender portal or into Sentinel's Logs page. Splunk queries are in SPL, for its Search page, and Velociraptor queries are in VQL, which you run as a hunt.

Sees It DirectlyDeviceProcessEvents

Reads the DeviceProcessEvents table in Defender XDR advanced hunting, from devices onboarded to Defender for Endpoint. Rare rows are leads, not proof, so compare them with a clean machine of the same build.

KQLDefender XDR, Advanced hunting

// sihost.exe by creator, folder and account, rarest first: SigmaHQ expects System32DeviceProcessEvents| where Timestamp > ago(30d)| where FileName =~ "sihost.exe"| summarize Copies = count(), Devices = dcount(DeviceName), LastSeen = max(Timestamp) by InitiatingProcessFileName, FolderPath, AccountName| order by Copies asc