Windows Process Creation: Suspicious Conhost.exe Child Processes

Flags conhost.exe spawning command/scripting utilities like PowerShell, MSHTA, or regsvr32.exe.

FreeUnreviewedSigmahighv1

windows-process-creation-suspicious-conhost-exe-child-processes-dfa03a09

title: "Windows Process Creation: Suspicious Conhost.exe Child Processes"
id: a24079e2-8666-4737-8756-75b1de71e4b2
related:
  - id: 7dc2dedd-7603-461a-bc13-15803d132355
    type: similar
  - id: dfa03a09-8b92-4d83-8e74-f72839b1c407
    type: derived
status: experimental
description: This rule identifies Windows process creation events where conhost.exe spawns child processes associated with common scripting and system utility execution (e.g., cmd.exe, powershell.exe, mshta.exe, regsvr32.exe). Attackers may leverage conhost.exe as a trusted component to launch these tools in a way that blends into normal activity. The detection relies on process creation telemetry, specifically the parent image ending with conhost.exe and the child process image/metadata matching the listed utilities and original file names.
references:
  - https://tria.ge/241015-l98snsyeje/behavioral2
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_conhost_susp_winshell_child_process.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-02-05
tags:
  - attack.stealth
  - attack.t1202
  - attack.t1218
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: \conhost.exe
  selection_child:
    - Image|endswith:
        - \cmd.exe
        - \cscript.exe
        - \mshta.exe
        - \powershell_ise.exe
        - \powershell.exe
        - \pwsh.exe
        - \regsvr32.exe
        - \wscript.exe
    - OriginalFileName:
        - cmd.exe
        - cscript.exe
        - mshta.exe
        - powershell_ise.exe
        - powershell.exe
        - pwsh.dll
        - regsvr32.exe
        - wscript.exe
  condition: all of selection_*
falsepositives:
  - Legitimate administrative tasks using `conhost.exe` to spawn child processes such as `cmd.exe`, `powershell.exe`, or `regsvr32.exe`.
level: high
license: DRL-1.1

What it detects

This rule identifies Windows process creation events where conhost.exe spawns child processes associated with common scripting and system utility execution (e.g., cmd.exe, powershell.exe, mshta.exe, regsvr32.exe). Attackers may leverage conhost.exe as a trusted component to launch these tools in a way that blends into normal activity. The detection relies on process creation telemetry, specifically the parent image ending with conhost.exe and the child process image/metadata matching the listed utilities and original file names.

Known false positives

Legitimate administrative tasks using `conhost.exe` to spawn child processes such as `cmd.exe`, `powershell.exe`, or `regsvr32.exe`.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.