Expected actions of svchost.exe - what is interesting, in the context of monitoring what svchost.exe is doing?

hi,

i have seen numerous articles explaining svchost, , think have reasonable grasp of (although basic).  favourite article far http://www.bleepingcomputer.com/tutorials/list-services-running-under-svchostexe-process/#advanced, think written , handy indeed!

my current issue tweaking security program called mcafee host ips, running on 2003 r2 , 2008 r2 servers, , getting lot of events associated svchost.exe believe require exceptions configured.  not want do, however, configure exception hides may useful information, there balance required in doing.

focusing on current task @ hand, can confirm have seen large number of events associated below.  below of information have on host ips signature in question, although digging further.

ips signature name: cmd tool access network aware application

ips signature details: event indicates attempt networked application access, modify or execute system program may used modify configuration of system.

ips signature severity: low

i have seen large number of events threat source process = c:\winnt\system32\svchost.exe, , following files, either accessed or executed.

c:\winnt\system32\tasklist.exe
c:\winnt\system32\ipconfig.exe
c:\winnt\system32\cmd.exe
c:\winnt\system32\route.exe

as above reference lists dlls specifically, , not exes, not sure if expected (but gathering is, ips signature details refers 'system programs').

i suspecting that my best action here configure exception threat source process <systemdir>\svchost.exe , target files <systemdir>\*.*, hypothesis if have not seen in tuning phase, there lot of similar benign actions potentially trigger in day day workings of os.  assuming see similar in later versions of windows server os.

to throw slight curveball, integrated siem solution.  signature severity low, mapped log action nothing stopped, if there no exceptions, relevant events go through siem.  filtered there, potentially used in correlation rules or troubleshooting, takes more space in mcafee (epo) database , siem solution, needs taken account.

thoughts on appreciated - genuinely wish knew more subject!

cheers,

darren

further above, proposed exceptions cover fingerprint of threat source process (svchost) in question.  looking @ timestamps on files, appear particular file changes - case?  searching cve.mitre.org cve master copy 'svchost' yields 1 vuln 2006!

Windows Server  >  Windows Server General Forum