DFSP # 368 - SVCHOST

Published: March 7, 2023, 5:01 a.m.

This week is a guide to understanding SVCHOST from a DFIR point of view. It is one of the most abused Windows processes, and having a firm working knowledge for investigations is essential.