Console Window host Located at: c:\windows\system32\conhost.exe.
conhostconhostSandbox: execFile · Timeout: 30s
security.execution.command Outputs
process.output Command execution output
process_spawn Produces
process.output| Resource | Value |
|---|---|
| CPU | low |
| Memory | 16 MB |
| Network | low |
| Disk I/O | low |
Execute a command line with conhost.exe as parent process (Use conhost.exe as a proxy binary to evade defensive counter-measures)
conhost.exe {CMD}Execute a command line with conhost.exe as parent process (Specify --headless parameter to hide child process window (if applicable))
conhost.exe --headless {CMD}| Type | Rule / Indicator |
|---|---|
| ioc | conhost.exe spawning unexpected processes |
| sigma | https://github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_conhost_susp_child_process.yml |
conhost is a Windows LOLBin. Console Window host Located at: c:\windows\system32\conhost.exe.