RoguePlanet: conhost.exe spawned as SYSTEM in interactive user session via named pipe hijack
Detects anomalous instances of conhost.exe running with SYSTEM integrity within an interactive user logon session. This behavior is indicative of session hijacking techniques, such as those leveraging named pipes or LaunchConsoleInSessionId, used to force console hosts into user-controlled sessions to potentially capture input or manipulate processes.
Microsoft Sentinel (KQL)
