Detection rules › Sigma

Suspicious High IntegrityLevel Conhost Legacy Option

Severity
informational
Author
frack113
Source
upstream

ForceV1 asks for information directly from the kernel space. Conhost connects to the console application. High IntegrityLevel means the process is running with elevated privileges, such as an Administrator context.

MITRE ATT&CK coverage

TacticTechniques
Defense EvasionT1202 Indirect Command Execution

Event coverage

ProviderEvent IDTitle
Sysmon1Process creation
Security-Auditing4688A new process has been created.

Stages and Predicates

Stage 1: selection

IntegrityLevel: [High, S-1-16-12288]
CommandLine|contains: -ForceV1
CommandLine|contains: 0xffffffff
CommandLine|contains: conhost.exe

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
CommandLinematch
  • -ForceV1
  • 0xffffffff
  • conhost.exe
IntegrityLeveleq
  • High corpus 16 (sigma 16)
  • S-1-16-12288 corpus 16 (sigma 16)