Windows ConHost Spawning Suspicious Script and Command-Line Child Processes

Flags conhost.exe spawning command/scripting utilities like PowerShell, MSHTA, or regsvr32.exe.

FreeReviewedSigma · High · v2

Product: windows
Category: process_creation
Author: Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2025-02-05
Updated: 2026-07-31

ATT&CK techniques

Defense Evasion

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
- T1202Indirect Command Execution
- T1218System Binary Proxy Execution
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags process creation events where conhost.exe spawns specific child executables associated with command execution and scripting, including cmd.exe, cscript.exe, mshta.exe, PowerShell variants, regsvr32.exe, and wscript.exe. This matters because conhost.exe is a trusted Windows component that can be used to launch script or utility interpreters as part of stealthy execution chains. The detection relies on process creation telemetry containing parent and child process image paths and, in some cases, original file names to match the invoked binaries.

Reporting behind it

Related detections9 linkedT1202 — drag to rearrange

Suspicious Child Process Creation from BgInfo.EXE on Windows

Windows: Suspicious Child Process Spawned by VsCode code.exe

Windows WSL Process Spawning Uncommon Child Executables

Windows: Alert on Unusual Child Process of Setres.EXE Spawning 'choice' Executables

Windows Process Creation: Detect Sysinternals Tool Name Impersonation by Executable

Windows ZipExec-Style Suspicious PowerShell/Command Execution with Password-Protected ZIP

Windows: Cmdl32.EXE Arbitrary File Download Indicator via /vpn and /lan Flags

Windows Process Creation: WSL (wsl.exe) Used for Arbitrary Command Execution

Windows renamed dctask64.exe execution via known IMPHASH values

Windows ConHost Spawning Suspicious Script and Command-Line Child Processes

Pivot detection · T1202 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-process-creation-suspicious-conhost-exe-child-processes-dfa03a09

title: Windows ConHost Spawning Suspicious Script and Command-Line Child Processes
id: a24079e2-8666-4737-8756-75b1de71e4b2
related:
  - id: 7dc2dedd-7603-461a-bc13-15803d132355
    type: similar
  - id: dfa03a09-8b92-4d83-8e74-f72839b1c407
    type: derived
status: experimental
description: This rule flags process creation events where conhost.exe spawns specific child executables associated with command execution and scripting, including cmd.exe, cscript.exe, mshta.exe, PowerShell variants, regsvr32.exe, and wscript.exe. This matters because conhost.exe is a trusted Windows component that can be used to launch script or utility interpreters as part of stealthy execution chains. The detection relies on process creation telemetry containing parent and child process image paths and, in some cases, original file names to match the invoked binaries.
references:
  - https://tria.ge/241015-l98snsyeje/behavioral2
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_conhost_susp_winshell_child_process.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-02-05
tags:
  - attack.stealth
  - attack.t1202
  - attack.t1218
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: \conhost.exe
  selection_child:
    - Image|endswith:
        - \cmd.exe
        - \cscript.exe
        - \mshta.exe
        - \powershell_ise.exe
        - \powershell.exe
        - \pwsh.exe
        - \regsvr32.exe
        - \wscript.exe
    - OriginalFileName:
        - cmd.exe
        - cscript.exe
        - mshta.exe
        - powershell_ise.exe
        - powershell.exe
        - pwsh.dll
        - regsvr32.exe
        - wscript.exe
  condition: all of selection_*
falsepositives:
  - Legitimate administrative tasks using `conhost.exe` to spawn child processes such as `cmd.exe`, `powershell.exe`, or `regsvr32.exe`.
level: high
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL