Conhost Spawned By Uncommon Parent Process

SigmaHQ Detections@sigmaHQ

•updated Apr 7, 2025•0•0•0

Detects when the Console Window Host (conhost.exe) process is spawned by an uncommon parent process, which could be indicative of potential code injection activity.