Conhost Spawned By Uncommon Parent Process
Detects when the Console Window Host (conhost.exe) process is spawned by an uncommon parent process, which could be indicative of potential code injection activity. The rule specifically looks for conhost.exe being spawned by processes other than a predefined list of common and legitimate parents, while also filtering out specific command-line patterns for svchost.exe and Dropbox to reduce false positives.
Sigma
