PowerShell Launch With --headless From Conhost.exe on Windows
Flags headless ConHost launching PowerShell on Windows based on process name and command-line arguments.
- Product
- windows
- Category
- process_creation
- Author
- Matt Anderson (Huntress) (SigmaHQ), DRL 1.1
- Published
- 2024-07-23
- Updated
- 2026-07-31
ATT&CK techniques
Execution → Defense EvasionRecon
Resource Dev
Initial Access
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies Windows process creations where PowerShell is launched with the --headless flag from a headless ConHost (conhost.exe) process. Attackers may use headless console hosting to reduce user visibility and facilitate stealthy command execution. The detection relies on Windows process creation telemetry, matching conhost.exe execution context and CommandLine content containing both --headless and powershell.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: PowerShell Launch With --headless From Conhost.exe on Windows
id: 7e7142ca-65a1-4e16-bf3c-60409574ec94
related:
- id: 00ca75ab-d5ce-43be-b86c-55ff39c6abfc
type: derived
- id: 056c7317-9a09-4bd4-9067-d051312752ea
type: derived
status: test
description: This rule identifies Windows process creations where PowerShell is launched with the --headless flag from a headless ConHost (conhost.exe) process. Attackers may use headless console hosting to reduce user visibility and facilitate stealthy command execution. The detection relies on Windows process creation telemetry, matching conhost.exe execution context and CommandLine content containing both --headless and powershell.
references:
- https://www.huntress.com/blog/fake-browser-updates-lead-to-boinc-volunteer-computing-software
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_conhost_headless_powershell.yml
author: Matt Anderson (Huntress), Huntrule Team
date: 2024-07-23
tags:
- attack.execution
- attack.stealth
- attack.t1059.001
- attack.t1059.003
- attack.t1564.003
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith: \conhost.exe
- OriginalFileName: CONHOST.EXE
selection_cli:
CommandLine|contains|all:
- --headless
- powershell
condition: all of selection_*
falsepositives:
- Unknown
level: medium
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_conhost_headless_powershell/info.yml
license: DRL-1.1