Description: Looks for suspicious svchosts running from outside the system32 folder
What The Data Shows: Shows if svchost processes are running from locations they shouldnt be. Its possible that malware, adware, or viruses are running as svchost.exe to hide.
SQL:
SELECT pid,u.username,p.name,f.path,h.sha256,
datetime(f.atime,"unixepoch","localtime") AS atime,
datetime(f.ctime,"unixepoch","localtime") AS ctime,
datetime(f.mtime,"unixepoch","localtime") AS mtime
FROM processes as p
JOIN file as f USING(path)
JOIN users AS u USING(uid)
JOIN hash AS h USING(path)
WHERE p.name = "svchost.exe"
AND lower(p.path) <> "c:\windows\system32\svchost.exe"
AND lower(p.path) <> "";
