Suspicious High IntegrityLevel Conhost Legacy Option — Detection Rule
ForceV1 asks for information directly from the kernel space. Conhost connects to the console application. High IntegrityLevel means the process is running with elevated privileges, such as an Administrator context.