Hayabusa informational test sigma

Suspicious High IntegrityLevel Conhost Legacy Option

ForceV1 asks for information directly from the kernel space. Conhost connects to the console application. High IntegrityLevel means the process is running with elevated privileges, such as an Administrator context.

View Source

Detection Logic

{
  "process_creation": {
    "EventID": 1,
    "Channel": "Microsoft-Windows-Sysmon/Operational"
  },
  "selection": {
    "IntegrityLevel": [
      "High",
      "S-1-16-12288"
    ],
    "CommandLine
| contains
| all": [
      "conhost.exe",
      "0xffffffff",
      "-ForceV1"
    ]
  },
  "condition": "process_creation and selection"
}

False Positives

⚠ Very Likely, including launching cmd.exe via Run As Administrator

Field Validations

Loading…

Comments (0)

Loading comments...