Windows ConHost Spawning Suspicious Script and Command-Line Child Processes

title: Windows ConHost Spawning Suspicious Script and Command-Line Child Processes
id: a24079e2-8666-4737-8756-75b1de71e4b2
related:
  - id: 7dc2dedd-7603-461a-bc13-15803d132355
    type: similar
  - id: dfa03a09-8b92-4d83-8e74-f72839b1c407
    type: derived
status: experimental
description: This rule flags process creation events where conhost.exe spawns specific child executables associated with command execution and scripting, including cmd.exe, cscript.exe, mshta.exe, PowerShell variants, regsvr32.exe, and wscript.exe. This matters because conhost.exe is a trusted Windows component that can be used to launch script or utility interpreters as part of stealthy execution chains. The detection relies on process creation telemetry containing parent and child process image paths and, in some cases, original file names to match the invoked binaries.
references:
  - https://tria.ge/241015-l98snsyeje/behavioral2
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_conhost_susp_winshell_child_process.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-02-05
tags:
  - attack.stealth
  - attack.t1202
  - attack.t1218
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: \conhost.exe
  selection_child:
    - Image|endswith:
        - \cmd.exe
        - \cscript.exe
        - \mshta.exe
        - \powershell_ise.exe
        - \powershell.exe
        - \pwsh.exe
        - \regsvr32.exe
        - \wscript.exe
    - OriginalFileName:
        - cmd.exe
        - cscript.exe
        - mshta.exe
        - powershell_ise.exe
        - powershell.exe
        - pwsh.dll
        - regsvr32.exe
        - wscript.exe
  condition: all of selection_*
falsepositives:
  - Legitimate administrative tasks using `conhost.exe` to spawn child processes such as `cmd.exe`, `powershell.exe`, or `regsvr32.exe`.
level: high
license: DRL-1.1