.. /Conhost.exe
Star

Console Window host

Paths:

c:\windows\system32\conhost.exe

Resources:

Acknowledgements:

Adam (@hexacorn)
Wietze (@wietze)

Detection:

IOC: conhost.exe spawning unexpected processes
Sigma: https://github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_conhost_susp_child_process.yml

Execute

Execute calc.exe with conhost.exe as parent process
```
conhost.exe calc.exe
```
Use case
Use conhost.exe as a proxy binary to evade defensive counter-measures

Privileges required
User

Operating systems
Windows 10, Windows 11

ATT&CK® technique
T1202
Execute calc.exe with conhost.exe as parent process
```
conhost.exe --headless calc.exe
```
Use case
Specify --headless parameter to hide child process window (if applicable)

Privileges required
User

Operating systems
Windows 10, Windows 11

ATT&CK® technique
T1202