How to Tell if svchost is Loading Malicious DLLs

A Little About me!

As a Cybersecurity Engineer specializing in penetration testing and a Splunk Administrator, I’m deeply passionate about exploring new concepts in the ever-evolving cyber landscape. This marks the beginning of my blogging journey, where I’ll share insights, lessons, and interesting discoveries from my learning experiences in cybersecurity and data analytics.

How it started

While diving into Splunk logs during an analysis, I stumbled upon a process called svchost—a name that pops up frequently in Windows environments. Curious about its role, I decided to dig deeper to understand how it works and why it’s so important

What is svchost and Why Does It Matter?

svchost.exe stands for Service Host, and it plays a critical role in Windows. Many Windows services are implemented as DLLs (Dynamic Link Libraries) rather than standalone executables. Since DLLs can’t run on their own, Windows uses svchost.exe as a container to load and execute these services. This design improves efficiency by grouping related services under a single process, reducing resource overhead

Purpose of svchost.exe

• Service Container: Windows services are often implemented as DLLs rather than standalone executables. svchost.exe loads these DLL-based services into memory and runs them.
• Grouping Services: Multiple services can share a single svchost.exe instance to reduce resource usage. For example, networking services might run under one instance, while update services run under another.
• Essential for OS Functionality: Core components like Windows Update, DHCP Client, DNS Client, and many others rely on svchost.exe.

Why Should Cybersecurity Professionals Care?

If svchost.exe loads a malicious DLL, it can give attackers stealthy persistence and privilege escalation. Detecting this isn’t always straightforward because svchost looks legitimate at first glance.

In my next section, I’ll dive into:

• How to identify if svchost is loading suspicious DLLs
• Techniques to prevent malicious DLL injection
• Splunk queries to monitor svchost behavior

How to identify if svchost is loading suspicious DLLs

1. Check Loaded Modules

• Use tools like:
• Process Explorer (Sysinternals): Shows all DLLs loaded by each svchost.exe instance.
• Or simply use the below command in PowerShell

Get-Process svchost | ForEach-Object { $_.Modules | Select ModuleName, FileName }

Look for DLLs outside standard Windows directories (e.g., C:\Windows\System32).

2. Verify Digital Signatures

• Legitimate DLLs should be signed by Microsoft.
• Use sigcheck.exe (Sysinternals) or PowerShell

Get-AuthenticodeSignature "C:\Path\To\DLL"

3. Compare Against Known Good Baseline

• Maintain a whitelist of expected DLLs for each service group.
• Any unexpected DLL is suspicious.

4. Monitor Behavior

• Use Event ID 4688 (process creation) and Sysmon Event ID 7 (image loaded) in Splunk or SIEM.
• Alert on DLLs loaded from user-writable directories (e.g., C:\Users\Public)

Techniques to prevent malicious DLL injection

1. Restrict Service DLL Paths

• Services specify their DLL path in the registry under

HKLM\SYSTEM\CurrentControlSet\Services\<ServiceName>\Parameters\ServiceDll

Ensure these paths point to trusted directories only.

2. Enable Windows Defender Exploit Guard / AppLocker

• AppLocker or Windows Defender Application Control can block DLLs from unauthorized locations.
• Create rules to allow only signed Microsoft DLLs in System32

Splunk queries to monitor svchost behavior

`sysmon_base`
EventCode=7
Image="C:\\Windows\\System32\\svchost.exe"
| eval is_suspicious_path=if(match(LoadedImage,"(?i)^C:\\Windows\\System32\\") OR match(LoadedImage,"(?i)^C:\\Windows\\SysWOW64\\"),0,1)
| where is_suspicious_path=1
| stats latest(_time) AS last_seen values(LoadedImage) AS dlls values(Signature) AS signature values(SignatureStatus) AS signature_status values(ProcessGuid) AS process_guid by host Image
| sort - last_seen

This concludes the end of my blog! Thanks for taking time to read!

Follow to read more!