Sigma informational test sigma

Suspicious High IntegrityLevel Conhost Legacy Option

ForceV1 asks for information directly from the kernel space. Conhost connects to the console application. High IntegrityLevel means the process is running with elevated privileges, such as an Administrator context.

View Source

Detection Logic

{
  "selection": {
    "IntegrityLevel": [
      "High",
      "S-1-16-12288"
    ],
    "CommandLine
| contains
| all": [
      "conhost.exe",
      "0xffffffff",
      "-ForceV1"
    ]
  },
  "condition": "selection"
}

False Positives

⚠ Very Likely, including launching cmd.exe via Run As Administrator

Field Validations

Loading…

Comments (0)

Loading comments...