Uncommon Child Process Of Conhost.EXE

SigmaHQ Detections@sigmaHQ

•updated Apr 28, 2026•0•0•0

Detects uncommon "conhost" child processes. This could be a sign of "conhost" usage as a LOLBIN or potential process injection activity.