..
/ Conhost.exe
Star
Execute
Console Window host
Paths:
c:\windows\system32\conhost.exe
Resources:
https://www.hexacorn.com/blog/2020/05/25/how-to-con-your-host/
https://twitter.com/Wietze/status/1511397781159751680
Acknowledgements:
Adam (
@hexacorn
)
Wietze (
@wietze
)
Detection:
IOC: conhost.exe spawning unexpected processes
Sigma:
https://github.com/SigmaHQ/sigma/blob/bea6f18d350d9c9fdc067f93dde0e9b11cc22dc2/rules/windows/process_creation/proc_creation_win_susp_conhost.yml
Execute
Execute calc.exe with conhost.exe as parent process
conhost.exe calc.exe
Usecase: Use conhost.exe as a proxy binary to evade defensive counter-measures
Privileges required: User
OS: Windows 10, Windows 11
MITRE ATT&CK®:
T1202