Masquerading conhost.exe running from user-profile Microsoft\Conhost path
Detects execution of conhost.exe from non-standard directories outside System32, SysWOW64, or WinSxS. Specifically targets drops within the user profile under AppData\Local\Microsoft\Conhost\ or when initiated by node.exe, which can indicate npm preinstall hooks or malware attempting to masquerade or abuse console host execution.
Microsoft Sentinel (KQL)
