Windows Child Process Spawned from conhost.exe with --headless

Alerts when conhost.exe launches a child process using the --headless flag.

FreeReviewedSigma · Medium · v5

Product: windows
Category: process_creation
Author: Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2024-07-23
Updated: 2026-07-31

ATT&CK techniques

Execution

Recon
Resource Dev
Initial Access
Execution
- T1059.001PowerShell
- T1059.003Windows Command Shell
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags Windows process creation where conhost.exe spawns a child process and its parent command line includes the "--headless" flag. Attackers can use headless execution to reduce user visibility, which may help tooling run quietly. Detection relies on process creation telemetry that includes the parent process image path and parent command line arguments.

Reporting behind it

Related detections9 linkedT1059.001 — drag to rearrange

MSSQL Server Process Spawning Command Shell via xp_cmdshell

Suspicious MSSQL xp_cmdshell OS Command Execution via sqlservr.exe (via process_creation)

Malicious Fire Ant Host-to-Guest Command Execution via VMware Tools (via process_creation)

Malicious Office Application Spawning a Command Shell or Script Interpreter (via process_creation)

Malicious PowerShell or Command Shell Spawned by SQL Server via xp_cmdshell

Windows AppLocker Audit-Mode Events Indicate Files Would Have Been Blocked

Windows Process Creation: CrushFTP spawning PowerShell, CMD, and scripting tool execution

Windows: Suspicious child processes spawned by CrushFTP service

Windows Process Chain Involving Notepad++ Launched via RDPInit and Executed Through CMD

Windows Child Process Spawned from conhost.exe with --headless

Pivot detection · T1059.001 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-headless-child-process-spawned-via-conhost-exe-00ca75ab

title: Windows Child Process Spawned from conhost.exe with --headless
id: 5d987a34-5658-4334-b42f-ce5be874d721
related:
  - id: 056c7317-9a09-4bd4-9067-d051312752ea
    type: derived
  - id: 00ca75ab-d5ce-43be-b86c-55ff39c6abfc
    type: derived
status: test
description: This rule flags Windows process creation where conhost.exe spawns a child process and its parent command line includes the "--headless" flag. Attackers can use headless execution to reduce user visibility, which may help tooling run quietly. Detection relies on process creation telemetry that includes the parent process image path and parent command line arguments.
references:
  - https://www.huntress.com/blog/fake-browser-updates-lead-to-boinc-volunteer-computing-software
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/process_creation/proc_creation_win_conhost_headless_execution.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2024-07-23
tags:
  - attack.execution
  - attack.t1059.001
  - attack.t1059.003
  - detection.threat-hunting
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \conhost.exe
    ParentCommandLine|contains: --headless
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL