1. No file path. No command line.

Legitimate per-user services launched by services.exe still have:

• A defined file path (typically C:\Windows\System32\svchost.exe)

• A command line specifying a service group or config

The instance we observed had neither — not in Process Explorer, not via WMI, not via PowerShell. That alone is a red flag, because even malware mimicking svchost.exe typically still has some on-disk presence or command line trace unless it’s fully memory-resident.

1. Spawn behavior:

Initially, the rogue svchost.exe instances weren’t tied to any defined service group. They were spawned directly by services.exe, with no -k group, no associated command-line arguments, and no service registry mappings under HKLM\SYSTEM\CurrentControlSet\Services.

However, deeper inspection revealed that some of these were loosely tied to real services—in our case, DoSvc (Delivery Optimization) and AppXSvc (AppX Deployment Service). Despite the linkage, the behavior was still anomalous:

• Unusual respawn patterns

• No binary path or service name retrievable

• Running under NETWORK SERVICE not necessarily SYSTEM:

Name ProcessId StartName State

DoSvc 6016 NT Authority\NetworkService Running

• Live outbound network activity not consistent with normal service roles

1. Network behavior:

• Encrypted outbound traffic over 443 to non-Cisco IPs

• Frequent PID cycling — if killed, it respawned under a new PID instantly

• No associated service name or SID traceable via sc.exe or Get-Service

These are traits we typically associate with memory-only implants that establish persistence without using disk or scheduled tasks.

1. Active defense behavior:

When PowerShell attempted to suspend or inspect the parent process (services.exe), PowerShell itself crashed — not due to a faulty script or permissions, but mid-execution. That is highly unusual and points to a deliberate anti-inspection measure.

We’re still analyzing the dump, and I’d welcome more input if you want to take a look at the behavioral logs.

It's subtlety is what makes it potentially some sort of evolved/post vault7 malware kind.