Conhost.exe

Console Window host

Paths

• c:\windows\system32\conhost.exe

Commands

Execute

Execute a command line with conhost.exe as parent process

Use case: Use conhost.exe as a proxy binary to evade defensive counter-measures

Privileges: User

conhost.exe {CMD}

Execute

Execute a command line with conhost.exe as parent process

Use case: Specify --headless parameter to hide child process window (if applicable)

Privileges: User

conhost.exe --headless {CMD}

Detection

• IOC: conhost.exe spawning unexpected processes
• Sigma: https://github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_conhost_susp_child_process.yml

Resources

• https://www.hexacorn.com/blog/2020/05/25/how-to-con-your-host/
• https://twitter.com/Wietze/status/1511397781159751680
• https://twitter.com/embee_research/status/1559410767564181504
• https://twitter.com/ankit_anubhav/status/1561683123816972288