huntrule

Windows conhost.exe Path Traversal in Command Line

Detects Windows conhost.exe command lines containing '/../../' path traversal indicators.

FreeUnreviewedSigmahighv1
title: Windows conhost.exe Path Traversal in Command Line
id: 1ae3890e-3182-4bec-a0f4-53a6d17e43c3
status: test
description: This rule flags process creation events where conhost.exe is associated with a command line containing the substring '/../../', indicating potential path traversal. Such sequences can be used to influence how arguments are interpreted, potentially leading to command/argument confusion or hijacking. The detection relies on Windows process creation telemetry that includes both the parent command line and the process command line.
references:
  - https://pentestlab.blog/2020/07/06/indirect-command-execution/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_conhost_path_traversal.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-06-14
tags:
  - attack.execution
  - attack.t1059.003
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentCommandLine|contains: conhost
    CommandLine|contains: /../../
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: ee5e119b-1f75-4b34-add8-3be976961e39
    type: derived

What it detects

This rule flags process creation events where conhost.exe is associated with a command line containing the substring '/../../', indicating potential path traversal. Such sequences can be used to influence how arguments are interpreted, potentially leading to command/argument confusion or hijacking. The detection relies on Windows process creation telemetry that includes both the parent command line and the process command line.

Known false positives

  • Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.