> For the complete documentation index, see [llms.txt](https://muhammed-hatem.gitbook.io/muhammed-hatem/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://muhammed-hatem.gitbook.io/muhammed-hatem/summaries/core-windows-processes/system/smss.exe/csrss.exe.md).

# csrss.exe

## csrss.exe - Technical Overview

### Definition

**csrss.exe** (Client Server Runtime Subsystem) is a core Windows process that manages the Win32 environment subsystem. It handles critical low-level OS functions like:

* Console window operations
* Thread creation/deletion
* Shutdown sequence coordination
* User-mode API validation

## csrss.exe Behavior Analysis

<table data-header-hidden><thead><tr><th width="174.33331298828125"></th><th></th><th></th></tr></thead><tbody><tr><td><mark style="color:blue;"><strong>Attribute</strong></mark></td><td><mark style="color:green;"><strong>Normal Behavior</strong></mark></td><td><mark style="color:red;"><strong>Abnormal Behavior</strong></mark></td></tr><tr><td><strong>Image Path</strong></td><td><code>%SystemRoot%\System32\csrss.exe</code></td><td>Path outside <code>C:\Windows\System32</code></td></tr><tr><td><strong>Parent Process</strong></td><td><code>smss.exe</code> (then terminates)</td><td>Persistent parent process</td></tr><tr><td><strong>Instances</strong></td><td>2+ instances (Session 0 + Session 1)</td><td>Misspelled variants (<code>crss.exe</code>, <code>csrsss.exe</code>)</td></tr><tr><td><strong>User Account</strong></td><td><code>NT AUTHORITY\SYSTEM</code></td><td>Non-SYSTEM user account</td></tr><tr><td><strong>Start Time</strong></td><td>Within seconds of boot (Sessions 0/1)</td><td>Unexpected timing (e.g., long after boot)</td></tr></tbody></table>

***

#### Key Technical Notes:

1. ✅**Normal Operation**:
   * Session 0 (services) and Session 1 (interactive) instances launch at boot
   * No persistent parent process (smss.exe terminates after spawning csrss.exe)
2. ❌**Malware Indicators**:
   * Paths like:\
     `C:\Temp\csrss.exe`\
     `%AppData%\csrss.exe`
   * Unusual child processes (e.g., `cmd.exe` spawned from csrss.exe)
   * Modified subsystem DLLs (`winsrv.dll`, `basesrv.dll`)
3. **Verification Commands**:

```powershell
# Check all csrss.exe instances:
Get-WmiObject Win32_Process | Where-Object { $_.Name -eq "csrss.exe" } |
  Select-Object ProcessId, ParentProcessId, ExecutablePath, CommandLine |
  Format-Table -AutoSize

# Validate digital signature:
Get-AuthenticodeSignature "$env:SystemRoot\System32\csrss.exe" |
  Select-Object Status, SignerCertificate | Format-List
```

⚠️ **Warning**: Terminating csrss.exe crashes the system. <br>

### Tactics & Techniques

<table data-header-hidden><thead><tr><th width="154.66668701171875"></th><th width="175"></th><th></th></tr></thead><tbody><tr><td><strong>Tactic</strong></td><td><strong>Technique</strong></td><td><strong>csrss.exe Abuse Example</strong></td></tr><tr><td><strong>Persistence</strong></td><td>T1547.004: Winlogon Helper DLL</td><td>Modifies <code>HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon</code> to load malicious DLL</td></tr><tr><td><strong>Privilege Escalation</strong></td><td>T1055: Process Injection</td><td>Injects code into csrss.exe to gain SYSTEM privileges</td></tr><tr><td><strong>Defense Evasion</strong></td><td>T1036: Process Masquerading</td><td>Renames malware to <code>crss.exe</code> in <code>%Temp%</code></td></tr><tr><td><strong>Execution</strong></td><td>T1204.002: Malicious File</td><td>Triggers malicious payload via thread execution</td></tr></tbody></table>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://muhammed-hatem.gitbook.io/muhammed-hatem/summaries/core-windows-processes/system/smss.exe/csrss.exe.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.