Windows PowerShell Execution via Headless ConHost (conhost.exe)

title: Windows PowerShell Execution via Headless ConHost (conhost.exe)
id: 7e7142ca-65a1-4e16-bf3c-60409574ec94
related:
  - id: 00ca75ab-d5ce-43be-b86c-55ff39c6abfc
    type: derived
  - id: 056c7317-9a09-4bd4-9067-d051312752ea
    type: derived
status: test
description: This rule matches process creations where conhost.exe is launched and the command line contains both the --headless flag and powershell. Headless ConHost can reduce user visibility of the PowerShell session, supporting stealthy execution. The detection relies on Windows process creation telemetry, specifically the executable identity and the full command line content.
references:
  - https://www.huntress.com/blog/fake-browser-updates-lead-to-boinc-volunteer-computing-software
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_conhost_headless_powershell.yml
author: Matt Anderson (Huntress), Huntrule Team
date: 2024-07-23
tags:
  - attack.execution
  - attack.stealth
  - attack.t1059.001
  - attack.t1059.003
  - attack.t1564.003
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \conhost.exe
    - OriginalFileName: CONHOST.EXE
  selection_cli:
    CommandLine|contains|all:
      - --headless
      - powershell
  condition: all of selection_*
falsepositives:
  - Unknown
level: medium
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_conhost_headless_powershell/info.yml
license: DRL-1.1