CatalogLOLBAS

LOL · Binary

Conhost.exe

2 techniquesWindowsLOLBASGPL-3.0

Execute

ExecutionWindows

Execute a command line with conhost.exe as parent process

Use Use conhost.exe as a proxy binary to evade defensive counter-measures

conhost.exe {CMD}
Evidence
Upstream reference
Environment
Local host
Context
user
Native
Execute
MITRE
T1202

Execute

ExecutionWindows

Execute a command line with conhost.exe as parent process

Use Specify --headless parameter to hide child process window (if applicable)

conhost.exe --headless {CMD}
Evidence
Upstream reference
Environment
Local host
Context
user
Native
Execute
MITRE
T1202