High RiskWindows

dllhost.exeEXECUTABLE

dllhost.exe - COM Surrogate Process Security Analysis [2026]

dllhost.exe (COM Surrogate) is a Windows process that hosts COM objects. Frequently abused by malware for process injection, proxy execution, and defense evasion due to its trusted status.

4viewsLast verified: Jan 18, 2025

Risk Summary

## Risk Summary | Factor | Assessment | |--------|------------| | Detection Difficulty | High | | Abuse Potential | Very High | | Prevalence | Universal | | Risk Score | 75/100 | dllhost.exe is a critical Windows component heavily abused by attackers for process injection and proxy execution.

What is dllhost.exe?

dllhost.exe (COM Surrogate) is a Windows system process that hosts out-of-process COM objects, providing isolation for potentially unstable COM components.

Key Characteristics

Attribute	Value
File Name	dllhost.exe
Developer	Microsoft Corporation
Digital Signature	Microsoft Windows
OS Component	Core Windows
Type	COM Host Process

Technical Details

Property	Description
Process Type	System Host
Parent Process	svchost.exe (DcomLaunch)
Purpose	Host out-of-process COM objects
Instances	Multiple normal

dllhost.exe isolates COM objects so crashes don't affect the calling application.

Normal Behavior

Legitimate Characteristics

Process: dllhost.exe
Parent: svchost.exe -k DcomLaunch
Location: C:\Windows\System32\dllhost.exe
Command: dllhost.exe /Processid:{CLSID}

Expected Characteristics

Aspect	Expected Behavior
Parent Process	svchost.exe (DcomLaunch)
Location	C:\Windows\System32\ only
Command Line	Contains /Processid:{GUID}
Instances	Multiple is normal
User Context	Various (SYSTEM, user)

Common CLSIDs

CLSID	Purpose
{3EB3C877-1F16-487C-9050-104DBCD66683}	Photo thumbnails
{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}	Thumbnail cache
{F9043C85-F6F2-101A-A3C9-08002B2F49FB}	Shell preview handler

C:\Windows\System32\dllhost.exeC:\Windows\SysWOW64\dllhost.exe

Suspicious Indicators

Red Flags

Indicator	Concern Level	Description
Wrong location	Critical	Not in System32/SysWOW64
No /Processid	High	Missing CLSID argument
Wrong parent	Critical	Not from svchost DcomLaunch
Network connections	High	dllhost rarely needs network
High CPU	Medium	Potential cryptominer

Suspicious Command Lines

# Suspicious patterns
dllhost.exe  # No /Processid argument
dllhost.exe /Processid:{random-guid}  # Unknown CLSID
C:\Users\...\dllhost.exe  # Wrong path
dllhost.exe -enc ...  # Encoded parameters

Injection Indicators

Pattern	Concern
Unusual DLLs loaded	Code injection
Network connections	C2 communication
Child processes	Proxy execution
Memory anomalies	Shellcode injection

Abuse Techniques

Process Injection

Injection Attack:
1. Identify running dllhost.exe process
2. Inject malicious code via various techniques
3. Code executes within trusted process
4. Evades application whitelisting
5. Inherits dllhost trust and permissions

COM Object Abuse

COM Hijacking:
1. Register malicious COM object
2. Trigger dllhost to load it
3. Malicious code runs in dllhost context
4. Appears as legitimate COM operation

Defense Evasion Techniques

Technique	Implementation
Process Hollowing	Replace dllhost memory
DLL Injection	Inject DLL into dllhost
COM Hijacking	Register malicious COM CLSID
Proxy Execution	Use dllhost to run code

Living-off-the-Land

# Malware spawning via COM
$obj = [activator]::CreateInstance([type]::GetTypeFromCLSID("CLSID"))
# Results in dllhost.exe running attacker code

Detection Guidance

Sysmon Configuration

<RuleGroup name="dllhost Monitoring" groupRelation="or">
  <ProcessCreate onmatch="include">
    <Image condition="end with">dllhost.exe</Image>
  </ProcessCreate>
  <NetworkConnect onmatch="include">
    <Image condition="end with">dllhost.exe</Image>
  </NetworkConnect>
  <CreateRemoteThread onmatch="include">
    <TargetImage condition="end with">dllhost.exe</TargetImage>
  </CreateRemoteThread>
</RuleGroup>

Sigma Rule

title: Suspicious dllhost.exe Execution
status: experimental
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    Image|endswith: '\dllhost.exe'
  filter_path:
    Image|startswith:
      - 'C:\Windows\System32\'
      - 'C:\Windows\SysWOW64\'
  filter_cmdline:
    CommandLine|contains: '/Processid:'
  condition: selection and not (filter_path and filter_cmdline)
  falsepositives:
    - Unusual COM operations
  level: high

KQL Query

// dllhost without proper arguments
DeviceProcessEvents
| where FileName =~ "dllhost.exe"
| where not(ProcessCommandLine contains "/Processid:")
| project Timestamp, DeviceName, ProcessCommandLine, InitiatingProcessFileName

// Network connections from dllhost
DeviceNetworkEvents
| where InitiatingProcessFileName =~ "dllhost.exe"
| project Timestamp, DeviceName, RemoteIP, RemotePort

// Wrong parent process
DeviceProcessEvents
| where FileName =~ "dllhost.exe"
| where not(InitiatingProcessCommandLine contains "DcomLaunch")
| project Timestamp, DeviceName, InitiatingProcessFileName

Remediation Steps

Verification

# Check all dllhost instances
Get-Process dllhost -ErrorAction SilentlyContinue | ForEach-Object {
    $wmi = Get-CimInstance Win32_Process -Filter "ProcessId = $($_.Id)"
    [PSCustomObject]@{
        PID = $_.Id
        Path = $_.Path
        CommandLine = $wmi.CommandLine
        ParentPID = $wmi.ParentProcessId
    }
}

# Verify signatures
Get-Process dllhost | ForEach-Object {
    Get-AuthenticodeSignature $_.Path
}

Incident Response

Finding	Action
Wrong path	Immediate containment
No /Processid	Investigate thoroughly
Network activity	Memory forensics
Unknown CLSID	Research COM object

Prevention

Control	Implementation
EDR	Monitor dllhost behavior
Application Control	Limit COM registrations
Network Monitoring	Alert on dllhost network

T1055 - Process Injection T1546.015 - Component Object Model Hijacking T1218 - System Binary Proxy Execution

Risk Summary

Overview

What is dllhost.exe?

Key Characteristics

Technical Details

Normal Behavior

Normal Behavior

Legitimate Characteristics

Expected Characteristics

Common CLSIDs

Common Locations

Suspicious Indicators

Suspicious Indicators

Red Flags

Suspicious Command Lines

Injection Indicators

Abuse Techniques

Abuse Techniques

Process Injection

COM Object Abuse

Defense Evasion Techniques

Living-off-the-Land

Detection Guidance

Detection Guidance

Sysmon Configuration

Sigma Rule

KQL Query

Remediation Steps

Remediation Steps

Verification

Incident Response

Prevention

Investigation Checklist

Investigation Checklist

Process Verification

Injection Detection

Network Analysis

COM Investigation

Timeline

MITRE ATT&CK Techniques