Suspicious High IntegrityLevel Conhost with Legacy Option

SigmaHQ Detections@sigmaHQ

•updated Dec 1, 2024•0•13

This rule detects the creation of a 'conhost.exe' process running with high integrity (elevated privileges) and using the '-ForceV1' and '0xffffffff' command-line options. This combination can be indicative of an attempt to bypass security controls or execute commands indirectly, as 'ForceV1' requests information directly from the kernel space and 'conhost' connects to the console application. This behavior has been observed in campaigns like Conti ransomware.