Suspicious High IntegrityLevel Conhost Legacy Option

Status: test
Severity: informational
Log source: category process_creation, product windows
Author: frack113
Source: github.com/SigmaHQ/sigma

ForceV1 asks for information directly from the kernel space. Conhost connects to the console application. High IntegrityLevel means the process is running with elevated privileges, such as an Administrator context.

Known false positives

Very Likely, including launching cmd.exe via Run As Administrator

MITRE ATT&CK coverage

Tactic	Techniques
Stealth	`T1202` Indirect Command Execution

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation
Security-Auditing	Event ID 4688: A new process has been created.

Rule body

title: Suspicious High IntegrityLevel Conhost Legacy Option
id: 3037d961-21e9-4732-b27a-637bcc7bf539
status: test
description: ForceV1 asks for information directly from the kernel space. Conhost connects to the console application. High IntegrityLevel means the process is running with elevated privileges, such as an Administrator context.
references:
    - https://cybercryptosec.medium.com/covid-19-cyber-infection-c615ead7c29
    - https://thedfirreport.com/2022/04/04/stolen-images-campaign-ends-in-conti-ransomware/
    - https://learn.microsoft.com/en-us/windows/win32/secauthz/mandatory-integrity-control
author: frack113
date: 2022-12-09
modified: 2024-12-01
tags:
    - attack.stealth
    - attack.t1202
logsource:
    product: windows
    category: process_creation
detection:
    selection:
        IntegrityLevel:
            - 'High'
            - 'S-1-16-12288'
        CommandLine|contains|all:
            - 'conhost.exe'
            - '0xffffffff'
            - '-ForceV1'
    condition: selection
falsepositives:
    - Very Likely, including launching cmd.exe via Run As Administrator
level: informational

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    IntegrityLevel:
        - 'High'
        - 'S-1-16-12288'
    CommandLine|contains|all:
        - 'conhost.exe'
        - '0xffffffff'
        - '-ForceV1'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`-ForceV1` `0xffffffff` `conhost.exe`	`field:"CommandLine" kind:match`
`IntegrityLevel`	eq	`High` corpus 21 (sigma 17, kusto 3, splunk 1) `S-1-16-12288` corpus 21 (sigma 17, kusto 3, splunk 1)	`field:"IntegrityLevel" kind:eq`