Windows Process Creation: conhost.exe -ForceV1 with High Integrity Level

Flags conhost.exe started with -ForceV1 from a High integrity process on Windows.

FreeUnreviewedSigmainformationalv1

windows-process-creation-conhost-exe-forcev1-with-high-integrity-level-3037d961

title: "Windows Process Creation: conhost.exe -ForceV1 with High Integrity Level"
id: 00123784-70ae-47ec-94fb-f4a0bf333894
status: test
description: This rule identifies Windows process creation events where conhost.exe is launched with the legacy -ForceV1 option while the process runs at High integrity (IntegrityLevel = High or S-1-16-12288). Elevated integrity conhost activity can indicate attempts to interact with console components from a privileged context. The detection relies on process creation telemetry, matching IntegrityLevel and specific command-line substrings.
references:
  - https://cybercryptosec.medium.com/covid-19-cyber-infection-c615ead7c29
  - https://thedfirreport.com/2022/04/04/stolen-images-campaign-ends-in-conti-ransomware/
  - https://learn.microsoft.com/en-us/windows/win32/secauthz/mandatory-integrity-control
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_conhost_legacy_option.yml
author: frack113, Huntrule Team
date: 2022-12-09
modified: 2024-12-01
tags:
  - attack.stealth
  - attack.t1202
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    IntegrityLevel:
      - High
      - S-1-16-12288
    CommandLine|contains|all:
      - conhost.exe
      - "0xffffffff"
      - -ForceV1
  condition: selection
falsepositives:
  - Very Likely, including launching cmd.exe via Run As Administrator
level: informational
license: DRL-1.1
related:
  - id: 3037d961-21e9-4732-b27a-637bcc7bf539
    type: derived

What it detects

This rule identifies Windows process creation events where conhost.exe is launched with the legacy -ForceV1 option while the process runs at High integrity (IntegrityLevel = High or S-1-16-12288). Elevated integrity conhost activity can indicate attempts to interact with console components from a privileged context. The detection relies on process creation telemetry, matching IntegrityLevel and specific command-line substrings.

Known false positives

Very Likely, including launching cmd.exe via Run As Administrator

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.