.. /Conhost.exe
Star

Console Window host

Paths:

c:\windows\system32\conhost.exe

Resources:

Acknowledgements:

Adam (@hexacorn)
Wietze (@wietze)

Detections:

IOC: conhost.exe spawning unexpected processes
Sigma: https://github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_conhost_susp_child_process.yml

Execute

Execute a command line with conhost.exe as parent process
```
conhost.exe {CMD}
```
Use case
Use conhost.exe as a proxy binary to evade defensive counter-measures

Privileges required
User

Operating systems
Windows 10, Windows 11

ATT&CK® technique
T1202
Tags
Execute: CMD
Execute a command line with conhost.exe as parent process
```
conhost.exe --headless {CMD}
```
Use case
Specify –headless parameter to hide child process window (if applicable)

Privileges required
User

Operating systems
Windows 10, Windows 11

ATT&CK® technique
T1202
Tags
Execute: CMD