Suspicious SearchProtocolHost.exe parent process

Analytics BIOC Medium

Suspicious SearchProtocolHost.exe parent process

SearchProtocolHost.exe has been launched from a process that is different from SearchIndexer.exe This may indicate malicious activity (such as malware later being injected to it, or it being used for phantom DLL hijacking).

Module:: Platform Analytics
Data source:: XDR Agent

ATT&CK tactics: Execution (TA0002) Defense Evasion (TA0005)

ATT&CK techniques: User Execution (T1204) System Binary Proxy Execution (T1218)

Attacker's goals:

Gain code execution on the host and evade security controls.

Investigative actions:

Check whether the executing process is benign and if this was a desired behavior as part of its normal execution flow.

Test period:: N/A (single event)
Deduplication:: 6 Hours