1200KM / sigma-rule
Conhost.exe CommandLine Path Traversal — Sigma Rule
Sigma rule ee5e119b-1f75-4b34-add8-3be976961e39. Conhost.exe CommandLine Path Traversal — Sigma Rule. detects the usage of path traversal in conhost.exe indicating possible command/argument confusion/hijacking
Rule metadata and linked tags
Author: Nasreddine Bencherchali (Nextron Systems). Source status: test; severity: high. Source dates: 2022-06-14 / not supplied.
{
"category": "process_creation",
"product": "windows"
}Pinned original Sigma rule · Detection Rule License 1.1
Source SHA-256: 4f70fa71b2b03619a80bfd775557451b538fc1bbb2e2a29ac16c8b4251e98c99
Detection logic
Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.
title: Conhost.exe CommandLine Path Traversal
id: ee5e119b-1f75-4b34-add8-3be976961e39
status: test
description: detects the usage of path traversal in conhost.exe indicating possible command/argument confusion/hijacking
references:
- https://pentestlab.blog/2020/07/06/indirect-command-execution/
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-06-14
tags:
- attack.execution
- attack.t1059.003
logsource:
category: process_creation
product: windows
detection:
selection:
ParentCommandLine|contains: 'conhost'
CommandLine|contains: '/../../'
condition: selection
falsepositives:
- Unlikely
level: high
False positives
- Unlikely
Source references
Connected ecosystem references
Exact source-tagged techniques
Telemetry review
Read the original logsource above, then inspect the linked detection workspaces for technique-level sensor context. No per-rule telemetry equivalence is inferred.
Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.