PowerShell Launch With --headless From Conhost.exe on Windows

Flags headless ConHost launching PowerShell on Windows based on process name and command-line arguments.

FreeReviewedSigma · Medium · v2

Product: windows
Category: process_creation
Author: Matt Anderson (Huntress) (SigmaHQ), DRL 1.1
Published: 2024-07-23
Updated: 2026-07-31

ATT&CK techniques

Execution → Defense Evasion

Recon
Resource Dev
Initial Access
Execution
- T1059.001PowerShell
- T1059.003Windows Command Shell
Persistence
Priv Esc
Defense Evasion
- T1564.003Hidden Window
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies Windows process creations where PowerShell is launched with the --headless flag from a headless ConHost (conhost.exe) process. Attackers may use headless console hosting to reduce user visibility and facilitate stealthy command execution. The detection relies on Windows process creation telemetry, matching conhost.exe execution context and CommandLine content containing both --headless and powershell.

Reporting behind it

Related detections9 linkedT1059.001 — drag to rearrange

MSSQL Server Process Spawning Command Shell via xp_cmdshell

Suspicious MSSQL xp_cmdshell OS Command Execution via sqlservr.exe (via process_creation)

Malicious Fire Ant Host-to-Guest Command Execution via VMware Tools (via process_creation)

Malicious Office Application Spawning a Command Shell or Script Interpreter (via process_creation)

Malicious PowerShell or Command Shell Spawned by SQL Server via xp_cmdshell

Windows AppLocker Audit-Mode Events Indicate Files Would Have Been Blocked

Windows Process Creation: CrushFTP spawning PowerShell, CMD, and scripting tool execution

Windows: Suspicious child processes spawned by CrushFTP service

Windows Process Chain Involving Notepad++ Launched via RDPInit and Executed Through CMD

PowerShell Launch With --headless From Conhost.exe on Windows

Pivot detection · T1059.001 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-powershell-execution-via-headless-conhost-conhost-exe-056c7317

title: PowerShell Launch With --headless From Conhost.exe on Windows
id: 7e7142ca-65a1-4e16-bf3c-60409574ec94
related:
  - id: 00ca75ab-d5ce-43be-b86c-55ff39c6abfc
    type: derived
  - id: 056c7317-9a09-4bd4-9067-d051312752ea
    type: derived
status: test
description: This rule identifies Windows process creations where PowerShell is launched with the --headless flag from a headless ConHost (conhost.exe) process. Attackers may use headless console hosting to reduce user visibility and facilitate stealthy command execution. The detection relies on Windows process creation telemetry, matching conhost.exe execution context and CommandLine content containing both --headless and powershell.
references:
  - https://www.huntress.com/blog/fake-browser-updates-lead-to-boinc-volunteer-computing-software
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_conhost_headless_powershell.yml
author: Matt Anderson (Huntress), Huntrule Team
date: 2024-07-23
tags:
  - attack.execution
  - attack.stealth
  - attack.t1059.001
  - attack.t1059.003
  - attack.t1564.003
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \conhost.exe
    - OriginalFileName: CONHOST.EXE
  selection_cli:
    CommandLine|contains|all:
      - --headless
      - powershell
  condition: all of selection_*
falsepositives:
  - Unknown
level: medium
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_conhost_headless_powershell/info.yml
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL