SYSTEM Conhost Execution from Unusual Parent Process

Bryant Smith@flowstate

•updated Jun 2, 2026•3•0•11

Detects the creation of conhost.exe running as NT AUTHORITY\SYSTEM, excluding expected system parent processes like csrss.exe and smss.exe. This behavior can be indicative of privilege escalation or an interactive system shell delivery, as seen in exploits like RedSun (CVE-2026-41091).