Conhost.exe

Execute a command line with conhost.exe as parent process

Use Use conhost.exe as a proxy binary to evade defensive counter-measures

conhost.exe {CMD}

Context

user

Native

Execute

MITRE

T1202

Detection

IOC: conhost.exe spawning unexpected processes

Sigma: github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_conhost_susp_child_process.yml

Refs

www.hexacorn.com/blog/2020/05/25/how-to-con-your-host/

twitter.com/Wietze/status/1511397781159751680

twitter.com/embee_research/status/1559410767564181504

twitter.com/ankit_anubhav/status/1561683123816972288

lolbas-project.github.io/lolbas/Binaries/Conhost/

Execute a command line with conhost.exe as parent process

Use Specify --headless parameter to hide child process window (if applicable)

conhost.exe --headless {CMD}

Context

user

Native

Execute

MITRE

T1202

Detection

IOC: conhost.exe spawning unexpected processes

Sigma: github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_conhost_susp_child_process.yml

Refs

www.hexacorn.com/blog/2020/05/25/how-to-con-your-host/

twitter.com/Wietze/status/1511397781159751680

twitter.com/embee_research/status/1559410767564181504

twitter.com/ankit_anubhav/status/1561683123816972288

lolbas-project.github.io/lolbas/Binaries/Conhost/