Suspicious High IntegrityLevel Conhost Legacy Option

Title: Suspicious High IntegrityLevel Conhost Legacy Option
Status: test
Description:ForceV1 asks for information directly from the kernel space. Conhost connects to the console application. High IntegrityLevel means the process is running with elevated privileges, such as an Administrator context.
References:
  -https://cybercryptosec.medium.com/covid-19-cyber-infection-c615ead7c29
  -https://thedfirreport.com/2022/04/04/stolen-images-campaign-ends-in-conti-ransomware/
  -https://learn.microsoft.com/en-us/windows/win32/secauthz/mandatory-integrity-control
Author: frack113
Date: 2022-12-09
modified:2024-12-01
Tags:

• -'attack.stealth'
• -'attack.t1202'

Logsource:

• product: windows
• category: process_creation

Detection:
  selection:
    IntegrityLevel:
      -'High'
      -'S-1-16-12288'

    CommandLine|contains|all:
      -'conhost.exe'
      -'0xffffffff'
      -'-ForceV1'

  condition:selection
Falsepositives:
  -Very Likely, including launching cmd.exe via Run As Administrator
Level: informational