Uncommon Child Process Of Conhost.EXE
This rule detects instances where 'conhost.exe' spawns an uncommon child process. Typically, 'conhost.exe' should only spawn itself or specific system processes. The detection of other child processes could indicate malicious activity, such as the use of 'conhost.exe' as a Living Off The Land Binary (LOLBIN) for indirect command execution or as a vector for process injection. The rule specifically filters out legitimate 'conhost.exe' child processes and cases where the child process image is null or empty, focusing on unexpected executables.
Sigma
