A service running within
SvcHost.exe or a third-party process accesses and enumerates the running processes with a permission set that allows it to close processes. But, it might not actually be trying to close processes.
The
Svchost.exe process is on your computer and hosts, or contains, other individual services that Windows uses to perform several functions. For example, Windows Defender uses a service that a
svchost.exe process hosts. There can be multiple instances of
svchost.exe running on your computer, with each instance containing different services. One instance of
svchost.exe might host a single service for a program, and another instance might host several services related to Windows. You can use Task Manager to view which services are running under each instance of
svchost.exe.
Some third-party applications enumerate processes with the privilege to close processes. This fact can cause the rule to be triggered many times per minute, depending on the application.
