huntrule

Windows Child Process Spawned from conhost.exe with --headless

Alerts when conhost.exe launches a child process using the --headless flag.

FreeReviewedSigma · Medium · v5
Product
windows
Category
process_creation
Author
Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2024-07-23
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Execution

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags Windows process creation where conhost.exe spawns a child process and its parent command line includes the "--headless" flag. Attackers can use headless execution to reduce user visibility, which may help tooling run quietly. Detection relies on process creation telemetry that includes the parent process image path and parent command line arguments.

Reporting behind it

Related detections9 linkedT1059.001 — drag to rearrange
MSSQL Server Process Spawning Command Shell via xp_cmdshell
Suspicious MSSQL xp_cmdshell OS Command Execution via sqlservr.exe (via process_creation)
Malicious Fire Ant Host-to-Guest Command Execution via VMware Tools (via process_creation)
Malicious Office Application Spawning a Command Shell or Script Interpreter (via process_creation)
Malicious PowerShell or Command Shell Spawned by SQL Server via xp_cmdshell
Windows AppLocker Audit-Mode Events Indicate Files Would Have Been Blocked
Windows Process Creation: CrushFTP spawning PowerShell, CMD, and scripting tool execution
Windows: Suspicious child processes spawned by CrushFTP service
Windows Process Chain Involving Notepad++ Launched via RDPInit and Executed Through CMD
Windows Child Process Spawned from conhost.exe with --headless
Pivot detection · T1059.001 · 9 related

Changelog

v5
  1. v5
    Candidate ingested via manual entry.2026-07-31
  2. v4
    Candidate ingested via manual entry.2026-07-31
  3. v3
    Candidate ingested via manual entry.2026-07-31
  4. v2
    Candidate ingested via manual entry.2026-07-31
  5. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.