anavem.
S
Low RiskWindows
SearchProtocolHost.exeEXECUTABLE

Windows Search Protocol Host - Data Source Handler [2026]

SearchProtocolHost.exe is a Windows Search component that handles protocol handlers for accessing data sources. May be impersonated by malware.

1viewsLast verified: Jan 18, 2025

Risk Summary

## Risk Summary | Factor | Assessment | |--------|------------| | Detection Difficulty | Low | | Abuse Potential | Low | | Prevalence | Universal | | Risk Score | 30/100 | SearchProtocolHost.exe is a Windows Search indexing component with low abuse potential but may be impersonated.

Overview

What is SearchProtocolHost.exe?

SearchProtocolHost.exe is a Windows Search component that hosts protocol handlers for accessing various data sources during the indexing process.

Key Characteristics

AttributeValue
File NameSearchProtocolHost.exe
DeveloperMicrosoft Corporation
Digital SignatureMicrosoft Windows
ServiceWindows Search (WSearch)
TypeProtocol Handler Host

Technical Details

PropertyDescription
Process TypeHost Process
Parent ProcessSearchIndexer.exe
PurposeHost data access protocols
Data SourcesFiles, Outlook, OneNote, etc.

SearchProtocolHost handles protocol handlers that access different data sources for the Windows Search index.

Normal Behavior

Normal Behavior

Legitimate Characteristics

Process: SearchProtocolHost.exe
Parent: SearchIndexer.exe
Location: C:\Windows\System32\
User: SYSTEM or LOCAL SERVICE

Expected Characteristics

AspectExpected Behavior
Parent ProcessSearchIndexer.exe
LocationC:\Windows\System32\
User ContextSYSTEM or LOCAL SERVICE
ActivityDuring indexing operations
InstancesMultiple during heavy indexing

Protocol Handlers

Data SourceProtocol
File systemfile://
Outlookmapi://
OneNoteonenote://
SharePointhttp:// (via handler)

Common Locations

C:\Windows\System32\SearchProtocolHost.exe

Suspicious Indicators

Suspicious Indicators

Red Flags

IndicatorConcern LevelDescription
Wrong locationCriticalNot in System32
Wrong parentHighNot from SearchIndexer
Wrong userMediumUnexpected user context
Network connectionsMediumExternal connections
Child processesHighSpawning other processes

Impersonation Indicators

Impersonation Signs:
- SearchProtocolHost outside System32
- Missing Microsoft signature
- Running as different user
- Unusual parent process
- Network activity to external hosts

Normal vs Suspicious

NormalSuspicious
Parent is SearchIndexerParent is cmd/explorer
Located in System32Located elsewhere
SYSTEM/LOCAL SERVICEUser account
No child processesSpawning children

Abuse Techniques

Abuse Techniques

Process Impersonation

Impersonation Scenario:
1. Attacker creates fake SearchProtocolHost.exe
2. Places in accessible location
3. Executes with trusted name
4. Blends with legitimate processes

Limited Abuse Potential

SearchProtocolHost has limited abuse potential:
- Runs with restricted privileges
- Parent process easy to verify
- Well-known behavior pattern
- No direct user interaction
- Sandboxed data access

Theoretical Exploitation

VectorFeasibility
Protocol handler bugPossible with crafted data
Privilege escalationLimited by sandbox
ImpersonationEasy to detect

Detection Guidance

Detection Guidance

Sysmon Configuration

<RuleGroup name="SearchProtocolHost Monitoring" groupRelation="or">
  <ProcessCreate onmatch="include">
    <Image condition="end with">SearchProtocolHost.exe</Image>
  </ProcessCreate>
  <NetworkConnect onmatch="include">
    <Image condition="end with">SearchProtocolHost.exe</Image>
  </NetworkConnect>
</RuleGroup>

Sigma Rule

title: Suspicious SearchProtocolHost
status: experimental
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    Image|endswith: '\SearchProtocolHost.exe'
  filter:
    Image: 'C:\Windows\System32\SearchProtocolHost.exe'
    ParentImage|endswith: '\SearchIndexer.exe'
  condition: selection and not filter
  falsepositives:
    - None expected
  level: high

KQL Query

// Wrong location or parent
DeviceProcessEvents
| where FileName =~ "SearchProtocolHost.exe"
| where FolderPath != "C:\\Windows\\System32\\" or
        InitiatingProcessFileName != "SearchIndexer.exe"
| project Timestamp, DeviceName, FolderPath, InitiatingProcessFileName

// Unexpected network connections
DeviceNetworkEvents
| where InitiatingProcessFileName =~ "SearchProtocolHost.exe"
| where RemoteIPType == "Public"
| project Timestamp, DeviceName, RemoteIP, RemoteUrl

Remediation Steps

Remediation Steps

Verification

# Check SearchProtocolHost processes
Get-Process -Name "SearchProtocolHost" -ErrorAction SilentlyContinue |
    ForEach-Object {
        Write-Host "PID: $($_.Id) Path: $($_.Path)"
        Get-AuthenticodeSignature $_.Path
    }

# Verify parent process
Get-CimInstance Win32_Process -Filter "name='SearchProtocolHost.exe'" |
    ForEach-Object {
        $parent = Get-Process -Id $_.ParentProcessId -ErrorAction SilentlyContinue
        Write-Host "Parent: $($parent.Name)"
    }

# Find impersonators
Get-ChildItem -Path C:\ -Recurse -Filter "SearchProtocolHost.exe" -ErrorAction SilentlyContinue |
    Where-Object { $_.DirectoryName -ne "C:\Windows\System32" }

Process Validation

CheckExpected
PathC:\Windows\System32\
ParentSearchIndexer.exe
SignatureMicrosoft Windows
UserSYSTEM/LOCAL SERVICE

Investigation Checklist

Investigation Checklist

Process Verification

  • Is process in correct location?
  • Is parent SearchIndexer.exe?
  • Proper Microsoft signature?
  • Running as expected account?

Behavior Analysis

  • Any child processes spawned?
  • Network connections present?
  • Unusual CPU/memory usage?
  • Abnormal disk activity?

Impersonation Check

  • Multiple copies on system?
  • Files in wrong locations?
  • Hash matches known good?

Search Index Health

  • Is Windows Search working?
  • Any index corruption?
  • Protocol handlers intact?

MITRE ATT&CK Techniques

T1036 - Masquerading