detection.wiki

Detection rules › Sigma

Suspicious High IntegrityLevel Conhost Legacy Option

Status
test
Severity
informational
Log source
product windows, category process_creation
Author
frack113
Source
github.com/SigmaHQ/sigma

ForceV1 asks for information directly from the kernel space. Conhost connects to the console application. High IntegrityLevel means the process is running with elevated privileges, such as an Administrator context.

MITRE ATT&CK coverage

TacticTechniques
StealthT1202 Indirect Command Execution

Event coverage

ProviderEventTitle
SysmonEvent ID 1Process creation
Security-AuditingEvent ID 4688A new process has been created.

Rule body yaml

title: Suspicious High IntegrityLevel Conhost Legacy Option
id: 3037d961-21e9-4732-b27a-637bcc7bf539
status: test
description: ForceV1 asks for information directly from the kernel space. Conhost connects to the console application. High IntegrityLevel means the process is running with elevated privileges, such as an Administrator context.
references:
    - https://cybercryptosec.medium.com/covid-19-cyber-infection-c615ead7c29
    - https://thedfirreport.com/2022/04/04/stolen-images-campaign-ends-in-conti-ransomware/
    - https://learn.microsoft.com/en-us/windows/win32/secauthz/mandatory-integrity-control
author: frack113
date: 2022-12-09
modified: 2024-12-01
tags:
    - attack.stealth
    - attack.t1202
logsource:
    product: windows
    category: process_creation
detection:
    selection:
        IntegrityLevel:
            - 'High'
            - 'S-1-16-12288'
        CommandLine|contains|all:
            - 'conhost.exe'
            - '0xffffffff'
            - '-ForceV1'
    condition: selection
falsepositives:
    - Very Likely, including launching cmd.exe via Run As Administrator
level: informational

Stages and Predicates

Stage 0: condition

selection

Stage 1: selection

selection:
    IntegrityLevel:
        - 'High'
        - 'S-1-16-12288'
    CommandLine|contains|all:
        - 'conhost.exe'
        - '0xffffffff'
        - '-ForceV1'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
CommandLinematch
  • -ForceV1
  • 0xffffffff
  • conhost.exe
IntegrityLeveleq
  • High corpus 21 (sigma 17, kusto 3, splunk 1)
  • S-1-16-12288 corpus 21 (sigma 17, kusto 3, splunk 1)