Windows: Headless Child Process Spawned via conhost.exe

title: "Windows: Headless Child Process Spawned via conhost.exe"
id: 5d987a34-5658-4334-b42f-ce5be874d721
related:
  - id: 056c7317-9a09-4bd4-9067-d051312752ea
    type: derived
  - id: 00ca75ab-d5ce-43be-b86c-55ff39c6abfc
    type: derived
status: test
description: This rule flags Windows process creation where a parent process named conhost.exe endswith '\conhost.exe' launches a child process and the parent command line contains the '--headless' flag. Attackers may use headless execution to reduce visible interaction with user sessions, improving stealth. The detection relies on Windows process creation telemetry, specifically parent image path ending in conhost.exe and parent command line arguments containing '--headless'.
references:
  - https://www.huntress.com/blog/fake-browser-updates-lead-to-boinc-volunteer-computing-software
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/process_creation/proc_creation_win_conhost_headless_execution.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2024-07-23
tags:
  - attack.execution
  - attack.t1059.001
  - attack.t1059.003
  - detection.threat-hunting
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \conhost.exe
    ParentCommandLine|contains: --headless
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1