svchost.exe

Windows services can be implemented either as standalone executables or as service DLLs. Service DLLs do not run on their own. The Service Control Manager (services.exe) launches an instance of svchost.exe with a -k <group> argument that names a service group. svchost then loads the DLL of every service registered to that group.

The groups are defined in the registry under HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost. Common ones include netsvcs, DcomLaunch, RPCSS, and LocalServiceNoNetwork. Adding -s <service> narrows an instance to one service from that group, for example svchost.exe -k netsvcs -p -s Schedule.

Since Windows 10 1703, systems with more than 3.5 GB of RAM split most service groups and give each service its own svchost instance. This is why modern machines commonly show 70 or more concurrent instances. The -p flag opts the instance into stricter mitigation policies such as signed-DLL-only loading.

Most instances start close to boot. Services also start on demand or at logon, so new svchost instances long after boot are normal. Windows 10 introduced per-user services for features such as notifications and clipboard. Those instances run under the signed-in user's account at Medium integrity rather than a service account.

svchost.exe is a top masquerading target. Malware frequently names itself svchost.exe or a look-alike such as svch0st.exe and runs from a directory other than System32. Watch for a svchost process running from anywhere except C:\Windows\System32 or C:\Windows\SysWOW64. Watch for a parent other than services.exe. Watch for an instance running without the -k service-group argument.

Attackers also commonly persist inside legitimate svchost instances. One method registers a malicious service DLL (T1543.003). Another hijacks an existing service's ServiceDll registry value. Path and parent checks will pass in both cases because the process image is the genuine signed binary. In these scenarios, analysts should examine the loaded modules instead. An unsigned or unexpected DLL inside a legitimate svchost process points to this kind of abuse.