svchost.exe: Windows Processes

Normal Profile

These are the values a genuine copy shows. Treat any value that differs as a lead.

Parent: services.exe (a value that published detection rules check for)Sources: Elastic: Unusual Parent-Child Relationship (opens in a new tab), SigmaHQ: Uncommon Svchost Parent Process (opens in a new tab)Elastic also accepts MsMpEng.exe, and SigmaHQ also lists Mrt.exe, ngen.exe, rpcnet.exe and TiWorker.exe.
Path: System32 or SysWOW64 (a value that published detection rules check for)C:\Windows\System32\svchost.exeSources: SigmaHQ: Suspicious Process Masquerading As SvcHost.EXE (opens in a new tab), Elastic: Potential Masquerading as Svchost (opens in a new tab)
Account: LocalSystem, LocalService or NetworkServiceSources: Microsoft Learn: Service host grouping in Windows 10 (opens in a new tab), LocalSystem Account (opens in a new tab), LocalService Account (opens in a new tab), NetworkService Account (opens in a new tab)Copies that host per-user services run as the person who signed in.
Session: 0Source: Microsoft Learn: Interactive Services (all services run in session 0) (opens in a new tab)Copies that host per-user services run as the person who signed in, so read their SessionId and do not assume 0.
Instances: Many: one per service above 3.5 GB of RAMSource: Microsoft Learn: Service host grouping in Windows 10 (opens in a new tab)At 3.5 GB or less, and for services kept together, one copy hosts several.
Starts: Compare each copy's start with its service's start type, which Get-Service shows, not with boot alone.
Command Line: A -k group, often followed by -p and by -s naming the service (a value that published detection rules check for)svchost.exe -k netsvcs -p -s NetSetupSvcSources: SigmaHQ: Suspect Svchost Activity (opens in a new tab), Conhost Spawned By Uncommon Parent Process (opens in a new tab)
Signed By: Check the file with Sigcheck or Get-AuthenticodeSignature, because many Windows files are signed through a catalogue, not in the file itself.

A value that published detection rules check for.No public source states this value, so compare with a clean machine of the same Windows build.

Why It Matters

Many genuine copies run, so its name is a favourite to borrow and code injected into one copy is easy to miss among the rest. A genuine copy runs from System32 or SysWOW64 with a -k group on its command line, and services.exe starts it in all but the few cases detection rules allow.

What It Does

svchost.exe, the Service Host, is a shell for loading services from DLL files, dynamic-link libraries that hold code another program loads and runs. Services with matching security needs share a group, and each group runs in its own copy, so a problem in one copy does not affect the others. services.exe starts each copy at boot or when one of its services is first needed, so new copies can appear long after start-up. Each copy runs as the account its services share, often LocalSystem, LocalService or NetworkService, apart from per-user services, which run as the person signed in. Many copies on one machine are normal. A copy from another folder, with no -k group or under another parent, is not.

Since Windows 10 version 1703, client machines with more than 3.5 GB of RAM give most services a copy each, while at 3.5 GB or less they stay grouped. Some always share, such as the Base Filtering Engine with Windows Firewall, and a SvcHostSplitDisable value of 1 keeps a service grouped.

Each copy's command line names its group after -k and often its service after -s, as SigmaHQ's rules show, so the arguments say what a copy hosts. Per-user services are created when a person signs in, run as that person and are deleted at sign-out. Windows names each one <service>_<LUID>, where the LUID is a locally unique identifier for that user context.

SigmaHQ calls an svchost.exe with no arguments extremely abnormal, usually a copy started to receive injected code, code that another process has placed into it. Elastic flags children of service hosts whose services normally start none.

How many svchost.exe copies a machine runs depends on its memory and on how each service is set. This table shows what decides it, so you know whether many copies, or a few shared ones, are normal on the machine in front of you.

Service Host Groups

What Decides It	What You See
More than 3.5 GB of RAM, on client editions of Windows 10 version 1703 or later	One copy per service, so many copies
3.5 GB of RAM or less	Services grouped by matching security needs, such as Local Service, Local System and Network Service
Services Microsoft keeps together	Base Filtering Engine with Windows Firewall, and RPC Endpoint Mapper with Remote Procedure Call
SvcHostSplitDisable set to 1 in a service's key	That service is never split out

Per-user services run as the person who signed in, so the svchost.exe copies that host them show that person's account, which is normal. These four come from Microsoft's list, with the name Windows gives each service and how it starts by default.

Per-User Services, Examples From Microsoft's List

Display Name	Service Name	Default Start Type
Connected Devices Platform User Service	`CDPUserSvc`	Automatic
Windows Push Notifications User Service	`WpnUserService`	Automatic
User Data Storage	`UnistoreSvc`	Manual
Consent UX User Service	`ConsentUxUserSvc`	Manual

How Attackers Abuse It

Each line is a way this process is misused, with the page that shows how to spot it.

Malware takes the name svchost.exe and runs from a user folder, among the many genuine copies.Wrong Path
An svchost.exe with no arguments at all, which SigmaHQ calls extremely abnormal, is usually a copy started to hold injected code.Odd Command Lines

In the Process Tree

These are the rows of the process list that this page explains.

svchost.exeService hosts, many copiesOpen it in the tree: svchost.exe

svchost.exeDCOM Server Process Launcher (-k DcomLaunch)Open it in the tree: svchost.exe
svchost.exeTask Scheduler service (Schedule)Open it in the tree: svchost.exe
svchost.exeUser Manager service (UserManager)Open it in the tree: svchost.exe

svchost.exeA per-user service (<service>_<LUID>), as the personOpen it in the tree: svchost.exe

On ws-042, 12 Oct 2026

scvhost.exeNamed like a service hostSuspiciousOpen it in the tree: scvhost.exe

Red Flags

Each sign below links to the page that shows how to confirm it.

A look-alike name, such as scvhost.exe with two letters swapped, which exact-name checks miss, so hunt look-alikes.Misspelt and Look-Alike Names
Any parent but services.exe, beyond the few exceptions detection rules allow.Wrong Parent
Any folder but System32 or SysWOW64.Wrong Path
No -k group on its command line. SigmaHQ calls a copy with no arguments at all extremely abnormal.Odd Command Lines
A person's account on a copy that hosts no per-user service.Wrong Account
A child from a copy whose service normally starts none, or executable memory no file backs.Remote Thread Injection

How to Check It

Each page shows how to check this process, on a running machine and in a memory image.

What Records It

Each record names its log and what must be switched on to get it.

Record and Where It Lands	What to Read	How to Turn It On
`DeviceProcessEvents` (opens in a new tab)Each row is a process creation or a related event, naming the new process, the process that created it and that creator's parent.Defender XDR, advanced hunting	For FileName svchost.exe, the InitiatingProcessFileName, FolderPath, ProcessCommandLine and AccountName of each copy.	The Defender for Endpoint sensor on the device
4688 `A new process has been created` (opens in a new tab)`Security`It is written on the computer the process ran on.	New Process Name svchost.exe with its Creator Process Name and, once the command line policy is on, its Process Command Line.Process Trees and Call Chains shows how to read it.	Turn on Audit Process Creation. For the command line, also turn on Include command line in process creation events.
1 `Process creation` (opens in a new tab)`Microsoft-Windows-Sysmon/Operational`It is written on any Windows computer running Sysmon.	Image svchost.exe with its ParentImage, User and CommandLine. OriginalFileName exposes a renamed copy.Process Trees and Call Chains shows how to read it.	Run Sysmon with ProcessCreate events in its configuration.

Hunt It

The same hunt is written for four tools, so pick the one you use. Defender XDR and Sentinel queries are in KQL, which you paste into Advanced hunting in the Defender portal or into Sentinel's Logs page. Splunk queries are in SPL, for its Search page, and Velociraptor queries are in VQL, which you run as a hunt.

Sees It DirectlyDeviceProcessEvents, with DeviceFileCertificateInfo

Reads the DeviceProcessEvents table in Defender XDR advanced hunting, from devices onboarded to Defender for Endpoint, so it covers copies started while the sensor runs. SigmaHQ allows a few more parents, such as TiWorker.exe and svchost.exe for TSLicensing. Add the ones your estate shows to the list, and keep the check.

KQLDefender XDR, Advanced hunting

// svchost.exe copies whose parent, path, arguments or signature break its profileDeviceProcessEvents| where Timestamp > ago(30d)| where FileName =~ "svchost.exe"| join kind=leftouter (    DeviceFileCertificateInfo    | summarize arg_max(Timestamp, IsSigned, IsTrusted, Signer, SignatureType) by SHA1    ) on SHA1| where InitiatingProcessFileName !in~ ("services.exe", "MsMpEng.exe")    or FolderPath !in~ (@"C:\Windows\System32\svchost.exe", @"C:\Windows\SysWOW64\svchost.exe", @"C:\Windows\System32", @"C:\Windows\SysWOW64")    or ProcessCommandLine !contains "-k"    or IsTrusted == false| project Timestamp, DeviceName, FolderPath, ProcessCommandLine, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, IsSigned, IsTrusted, Signer, SignatureType| order by Timestamp desc

Changes by Version

This process has changed between versions, so read a machine against its own.

Windows 10 version 1703 Services split into a copy each on client machines with more than 3.5 GB of RAM.

Check It in the Registry: Services