searchhost.exe

SearchHost.exe is a packaged (UWP) system app that presents the taskbar search experience and its results, distinct from SearchIndexer.exe, which builds the file index it can draw on. It runs as the logged-on user, launched as part of the session, from a Windows SystemApps package folder rather than System32, and is signed by Microsoft.

Legitimately, SearchHost is present on Windows 11 desktops and suspended when idle. Because the search UI integrates web results, some network activity to Microsoft's search endpoints is normal, which sets it apart from the other shell hosts.

SearchHost.exe is a baseline process. Its identity is fixed, the logged-on user's account, a packaged Microsoft signature, and no child processes, so deviations stand out. Unlike the purely local shell hosts it does talk to Microsoft's search service, so the meaningful network signal is connections to unrelated hosts, not network activity as such. The realistic abuse is impersonation (T1036.005), where malware uses the name from a path outside the genuine packaged location.

As a persistent per-user process it could also be injected into (T1055). A SearchHost that spawns programs or reaches hosts outside the search service is acting outside its role.