Suspicious High IntegrityLevel Conhost Legacy Option — Sigma Rule

Rule metadata and linked tags

Author: frack113. Source status: test; severity: informational. Source dates: 2022-12-09 / 2024-12-01.

{
  "product": "windows",
  "category": "process_creation"
}

Pinned original Sigma rule · Detection Rule License 1.1

Source SHA-256: 6523116c59112f00565d70cee92267740f84a4f90acd35c6c32ec5bca91ad776

Detection logic

Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.

title: Suspicious High IntegrityLevel Conhost Legacy Option
id: 3037d961-21e9-4732-b27a-637bcc7bf539
status: test
description: ForceV1 asks for information directly from the kernel space. Conhost connects to the console application. High IntegrityLevel means the process is running with elevated privileges, such as an Administrator context.
references:
    - https://cybercryptosec.medium.com/covid-19-cyber-infection-c615ead7c29
    - https://thedfirreport.com/2022/04/04/stolen-images-campaign-ends-in-conti-ransomware/
    - https://learn.microsoft.com/en-us/windows/win32/secauthz/mandatory-integrity-control
author: frack113
date: 2022-12-09
modified: 2024-12-01
tags:
    - attack.stealth
    - attack.t1202
logsource:
    product: windows
    category: process_creation
detection:
    selection:
        IntegrityLevel:
            - 'High'
            - 'S-1-16-12288'
        CommandLine|contains|all:
            - 'conhost.exe'
            - '0xffffffff'
            - '-ForceV1'
    condition: selection
falsepositives:
    - Very Likely, including launching cmd.exe via Run As Administrator
level: informational

Original YAML and metadata in JSON

False positives

• Very Likely, including launching cmd.exe via Run As Administrator

Source references

• https://cybercryptosec.medium.com/covid-19-cyber-infection-c615ead7c29
• https://thedfirreport.com/2022/04/04/stolen-images-campaign-ends-in-conti-ransomware/
• https://learn.microsoft.com/en-us/windows/win32/secauthz/mandatory-integrity-control