The Svchost.exe process is on your computer and hosts, or contains, other individual services that Windows uses to perform several functions. For example, Windows Defender uses a service that a svchost.exe process hosts. There can be multiple instances of svchost.exe running on your computer, with each instance containing different services. One instance of svchost.exe might host a single service for a program, and another instance might host several services related to Windows. You can use Task Manager to view which services are running under each instance of svchost.exe.

Some third-party applications enumerate processes with the privilege to close processes. This fact can cause the rule to be triggered many times per minute, depending on the application.