Rare process spawned by srvany.exe

Analytics BIOC Informational

Rare process spawned by srvany.exe

Unusual process spawned by srvany.exe, which allows applications to run as services with system privileges, this might be an indication of malicious local or remote code execution.

Module:: Platform Analytics
Data source:: XDR Agent

ATT&CK tactics: Execution (TA0002)

ATT&CK techniques: System Services: Service Execution (T1569.002)

Attacker's goals:

Execute malware on the host in a manner that doesn't leave event logs within the system.

Investigative actions:

Validate if the binary that srvany.exe executed is malicious. Track down the source of the srvany.exe binary and the executed process. Validate if this is a legitimate software installed by IT.

Test period:: N/A (single event)
Deduplication:: 1 Hour