taskhostw
Host Process for Windows Tasks
Expected under a service host, in System32. A task's own program does not run under it.
- Normal Processes
- Open it in the tree
Normal Profile
These are the values a genuine copy shows. Treat any value that differs as a lead.
- Parent
- svchost.exe (a value that published detection rules check for)Sources: Elastic: Unusual Parent-Child Relationship (opens in a new tab), Velociraptor: Windows.Attack.ParentProcess (opens in a new tab)Elastic's rule also accepts services.exe.
- Path
- System32 (a value that published detection rules check for)
C:\Sources: Velociraptor: Windows.Attack.UnexpectedImagePath (opens in a new tab), SigmaHQ: System File Execution Location Anomaly (opens in a new tab)Windows\ System32\ taskhostw.exe - Account
- Read each copy's token on a clean machine of the same build, with Process Explorer live or windows.getsids in memory.
- Session
- Read each copy's SessionId with Get-CimInstance Win32_Process or windows.pslist on a clean machine of the same build.
- Instances
- Count copies per session on a clean machine of the same build, before and after a second sign-in.
- Starts
- Compare each copy's start with the boot and the sign-in on a clean machine of the same build.
- Command Line
- Read it elevated with Get-CimInstance Win32_Process on a clean machine of the same build.
- Signed By
- Check the file with Sigcheck, which reads catalogue signatures too, on a clean machine of the same build.
A value that published detection rules check for.No public source states this value, so compare with a clean machine of the same Windows build.
Why It Matters
The program a scheduled task runs starts under the Task Scheduler's own service host, not under taskhostw.exe, so judge a copy by its parent and folder. One outside System32, or started by anything but svchost.exe or services.exe, needs a reason.
What It Does
Microsoft Learn has no page for taskhostw.exe, so its profile rests on detection rules. Elastic and Velociraptor expect a service host (svchost.exe) to start it, Elastic also allows services.exe, and Velociraptor and SigmaHQ expect it in System32. Despite its name, the program a scheduled task runs does not start under it. It starts under the service host running the Schedule service, as Elastic's scheduled task rule expects, so a task's program has that svchost.exe as its parent, not taskhostw.exe. A copy outside System32, or started by anything but svchost.exe or services.exe, is the one to check.
Read taskhostw.exe's own account, session and command line on a clean machine of the same build before judging a copy. The Registry's TaskCache key lists the tasks that exist, and event 4698 in the Security log records each new one where Audit Other Object Access Events is on.
How Attackers Abuse It
Each line is a way this process is misused, with the page that shows how to spot it.
- Malware takes the name taskhostw.exe and runs from a user folder, where SigmaHQ's location rule catches it.Wrong Path
- Malware takes the name taskhostw.exe and starts under a parent other than svchost.exe or services.exe, which Elastic's rule flags.Wrong Parent
Red Flags
Each sign below links to the page that shows how to confirm it.
- A creator other than svchost.exe, though Elastic's rule also allows services.exe.Wrong Parent
- Any folder but C:\Windows\System32.Wrong Path
- A taskhostw.exe with no valid signature, embedded or through a catalogue.Renamed, Unsigned or Falsely Signed Binaries
How to Check It
Each page shows how to check this process, on a running machine and in a memory image.
What Records It
Each record names its log and what must be switched on to get it.
| Record and Where It Lands | What to Read | How to Turn It On |
|---|---|---|
4688 A new process has been created (opens in a new tab)SecurityIt is written on the computer the process ran on. | For a New Process Name ending in taskhostw.exe, the Creator Process Name should be svchost.exe or services.exe.Process Trees and Call Chains shows how to read it. | Turn on Audit Process Creation. For the command line, also turn on Include command line in process creation events. |
1 Process creation (opens in a new tab)Microsoft-Windows-Sysmon/OperationalIt is written on any Windows computer running Sysmon. | Image, ParentImage and User for each copy.Process Trees and Call Chains shows how to read it. | Run Sysmon with ProcessCreate events in its configuration. |
| Device | FolderPath, Initiating | The Defender for Endpoint sensor on the device |
4698 A scheduled task was created (opens in a new tab)SecurityIt is written on the computer the task was created on. | Each new task, with its XML in Task Content, which names the program it runs and the account it runs as. | Turn on Audit Other Object Access Events. |
Hunt It
The same hunt is written for four tools, so pick the one you use. Defender XDR and Sentinel queries are in KQL, which you paste into Advanced hunting in the Defender portal or into Sentinel's Logs page. Splunk queries are in SPL, for its Search page, and Velociraptor queries are in VQL, which you run as a hunt.
Reads the DeviceProcessEvents table in Defender XDR advanced hunting, from devices onboarded to Defender for Endpoint. Before you read no rows as clean, check that it recorded the genuine copy at a recent boot or sign-in. A hit is a lead, so check the file's signer and where it came from before you call it malicious.
// taskhostw.exe outside C:\Windows\System32, or created by anything but svchost.exe or services.exeDeviceProcessEvents| where Timestamp > ago(Sources
- Elastic: Unusual Parent-Child Relationship (opens in a new tab)
- Velociraptor: Windows.Attack.ParentProcess (opens in a new tab)
- Velociraptor: Windows.Attack.UnexpectedImagePath (opens in a new tab)
- SigmaHQ: System File Execution Location Anomaly (opens in a new tab)
- Elastic: Suspicious Execution via Scheduled Task (opens in a new tab)