Suspicious Child Processes from ConHost

SigmaHQ Detections@sigmaHQ

•updated Oct 1, 2025•1•0•23

Detects suspicious child processes related to Windows Shell utilities spawned by `conhost.exe`, which could indicate malicious activity using trusted system components. This rule specifically looks for `conhost.exe` spawning `cmd.exe`, `cscript.exe`, `mshta.exe`, `powershell_ise.exe`, `powershell.exe`, `pwsh.exe`, `regsvr32.exe`, or `wscript.exe`.