Expected actions of svchost.exe - what is interesting, in the context of monitoring what svchost.exe is doing?

Question

Hi,
I have seen numerous articles explaining svchost, and I think I have a reasonable grasp of it (although basic).  My favourite article so far is
http://www.bleepingcomputer.com/tutorials/list-services-running-under-svchostexe-process/#advanced, which I think is well written and very handy indeed!
My current issue is that I am tweaking a security program called McAfee Host IPS, currently running on 2003 R2 and 2008 R2 servers, and getting a lot of events associated with svchost.exe that I believe require exceptions to be configured.  What I do
not want to do, however, is configure an exception that hides something that may be useful information, however there is a balance required in what I am doing.
Focusing on my current task at hand, I can confirm I have seen a large number of events associated with the below.  The below is all of the information I have on the Host IPS signature in question, although I am currently digging further.
IPS Signature Name: CMD Tool Access by a Network Aware Application
IPS Signature details: This event indicates an attempt by a networked application to access, modify or execute a system program that may be used to modify the configuration of your system.
IPS Signature severity: Low
I have seen a large number of events with threat source process = C:\WINNT\SYSTEM32\SVCHOST.EXE, and the following files, either accessed or executed.
C:\WINNT\System32\tasklist.exe
C:\WINNT\System32\ipconfig.exe
C:\WINNT\System32\cmd.exe
C:\WINNT\System32\route.exe
As the above reference lists DLLs specifically, and not EXEs, I am not sure if this is expected (but am gathering it is, especially as the IPS signature details refers to 'system programs').
I am suspecting that my best action here is to configure an exception for threat source process <systemdir>\SVCHOST.EXE and target files <systemdir>\*.*, as my hypothesis is that even if I have not seen it in the tuning phase, there are
a lot of similar benign actions that could potentially trigger in the day to day workings of the OS.  I am also assuming that I will see similar in later versions of Windows Server OS.
To throw a slight curveball, we are also integrated with a SIEM solution.  As this signature severity is low, it is mapped to a log action so nothing will actually be stopped, but if there are no exceptions, relevant events would go through to SIEM. 
They could be filtered there, but potentially used in correlation rules or troubleshooting, but that obviously takes more space in the McAfee (ePO) database and the SIEM solution, which needs to be taken into account.
Thoughts on this would be greatly appreciated - I genuinely wish I knew more about this subject!
Cheers,
Darren

Answer 1

Hi,
I am not sure what specific information you are looking for - could you clarify?  I think I have covered the majority of what is happening in my initial post, however if there is a specific bit of information you are after, let me know.
The above is an article I had stumbled across, with the majority of the information contained in the link included in my initial post.  The final paragraph under 'could this process be a virus' is interesting - I have copied it below - from your perspective
is this merely anecdotal or is there something behind it (references, if they exist, would be fantastic)?
"As long as you make sure that the location of the file is in your Windows\System32 directory, you aren’t dealing with a virus. There have been cases of certain viruses trying to mimic the same filename, but they are always located in another directory."
- source: http://www.howtogeek.com/howto/windows-vista/what-is-svchostexe-and-why-is-it-running/ , 09/01/15