Potentially Suspicious Child Processes Spawned by ConHost

SigmaHQ Detections@sigmaHQ

•updated Apr 28, 2026•0•0•0

Detects suspicious child processes related to Windows Shell utilities spawned by `conhost.exe`, which could indicate malicious activity using trusted system components.