Conhost.exe

Commands

1. ExecuteUser T1202

   Use conhost.exe as a proxy binary to evade defensive counter-measures

   conhost.exe {CMD}

   Execute a command line with conhost.exe as parent process

   os: Windows 10, Windows 11

   Execute: CMD

2. ExecuteUser T1202

   Specify --headless parameter to hide child process window (if applicable)

   conhost.exe --headless {CMD}

   Execute a command line with conhost.exe as parent process

   os: Windows 10, Windows 11

   Execute: CMD

Detection

• IOCconhost.exe spawning unexpected processes
• Sigma https://github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_conhost_susp_child_process.yml

Resources

• https://www.hexacorn.com/blog/2020/05/25/how-to-con-your-host/
• https://twitter.com/Wietze/status/1511397781159751680
• https://twitter.com/embee_research/status/1559410767564181504
• https://twitter.com/ankit_anubhav/status/1561683123816972288