.. /Conhost.exe
Star

Console Window host

Paths:

c:\windows\system32\conhost.exe

Resources:

Acknowledgements:

Adam (@hexacorn)
Wietze (@wietze)

Detections:

IOC: conhost.exe spawning unexpected processes
Sigma: proc_creation_win_conhost_susp_child_process.yml

Execute

Execute a command line with conhost.exe as parent process
```
conhost.exe cmd /c c:\windows\system32\calc.exe
```
Use case
Use conhost.exe as a proxy binary to evade defensive counter-measures

Privileges required
User

Operating systems
Windows 10, Windows 11

ATT&CK® technique
T1202: Indirect Command Execution
Tags
Execute: CMD
Execute a command line with conhost.exe as parent process
```
conhost.exe --headless cmd /c c:\windows\system32\calc.exe
```
Use case
Specify --headless parameter to hide child process window (if applicable)

Privileges required
User

Operating systems
Windows 10, Windows 11

ATT&CK® technique
T1202: Indirect Command Execution
Tags
Execute: CMD