Conhost.exe Command Line Path Traversal
This rule detects the usage of path traversal techniques within the command line of 'conhost.exe'. This behavior can indicate an attempt to confuse or hijack command arguments, potentially leading to indirect command execution. Specifically, it looks for '/../../' in the command line when 'conhost' is present in the parent command line.
Sigma
