Medium RiskWindowsLegitimateCommonly Abused
RuntimeBroker.exeSYSTEM PROCESSRuntimeBroker.exe - Runtime Broker Security Analysis
RuntimeBroker.exe manages **permissions for Windows Store (UWP) apps**. It runs in user context and is common on Windows 10/11 systems. While less commonly abused than other system processes, attackers may **masquerade malware** as RuntimeBroker.exe to blend with normal system activity.
Risk Summary
MEDIUM priority for SOC triage. RuntimeBroker.exe is a legitimate Windows process for UWP app permissions. Monitor for instances outside System32, unusual parent processes, or multiple unexpected instances.
Overview
What is RuntimeBroker.exe?
RuntimeBroker.exe manages permissions for Windows Store applications.
Core Functions
UWP App Management:
- Manage app permissions
- Control app capabilities
- Broker between apps and system
Security Significance
- Common Process: Multiple instances normal
- User Context: Runs per-user
- Masquerade Target: Name used by malware
Normal Behavior
Normal Behavior
Expected Process State
| Property | Expected Value |
|---|---|
| Path | C:\Windows\System32\RuntimeBroker.exe |
| Parent | svchost.exe |
| User | Current user |
| Instances | Multiple (one per UWP app) |
| Network | Usually none |
Common Locations
C:\Windows\System32\RuntimeBroker.exeSuspicious Indicators
Legitimate vs Suspicious
LEGITIMATE
Path: C:\Windows\System32\RuntimeBroker.exe
Parent: svchost.exe
User: Current user
SUSPICIOUS
Path: C:\Windows\RuntimeBroker.exe
C:\Users\*\RuntimeBroker.exe
Parent: explorer.exe, cmd.exe
Network: Outbound connections
Abuse Techniques
Attack Techniques
Technique #1: Process Masquerading (T1036.005)
Malware using RuntimeBroker.exe name to blend in.
Technique #2: Process Injection (T1055)
Injecting into RuntimeBroker.exe for persistence.
Detection Guidance
Detection Strategies
Priority #1: Path Verification
Process = "RuntimeBroker.exe" AND
Path != "C:\Windows\System32\RuntimeBroker.exe"
→ ALERT: CRITICAL
Priority #2: Parent Validation
Process = "RuntimeBroker.exe" AND
Parent != "svchost.exe"
→ ALERT: HIGH
Remediation Steps
Protection and Remediation
If Compromise Suspected
- Verify path is System32
- Check parent process
- Compare hash with known-good
- Review for injection
Investigation Checklist
Investigation Checklist
- Verify path is C:\Windows\System32
- Confirm parent is svchost.exe
- Check for unusual network activity
- Compare file hash
MITRE ATT&CK Techniques
Last verified: January 18, 2026