dashost.exe

dasHost.exe runs the Device Association Framework, which handles discovering, pairing, and connecting devices to the machine. It is started by the Device Association service through svchost.exe, runs under a service account (LOCAL SERVICE or NETWORK SERVICE), and lives at C:\Windows\System32\dasHost.exe.

Legitimately, dasHost runs in the background whenever device association is active. It manages devices rather than launching programs, so it does not normally start other processes, and its name is sometimes mistaken for something suspicious precisely because it is unfamiliar.

dasHost.exe is a baseline process whose main relevance is impersonation (T1036.005). Its unusual name, and the fact that few people recognize it, make it a tempting cover for malware: a process named dasHost.exe outside System32, unsigned, under the wrong account, or without a svchost.exe parent is the deviation to investigate.

As a persistent service-context process it could also be injected into (T1055). dasHost spawning programs or reaching the network beyond device functions is outside its normal role.