Identifier / Programs / Windows
conhost.exe
Console Window Host file version info (xCyclopedia)
LOLBAS Execute 14 Sigma rules name it 7 ATT&CK techniques 2 documented commands 10 known copies with hashes
How conhost.exe is abused
Execute T1202 Indirect Command Execution
--headlessEach abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for conhost.exe.
2 documented commands
Execute T1202 Indirect Command Execution User privileges
Execute a command line with conhost.exe as parent process
conhost.exe {CMD}Execute T1202 Indirect Command Execution User privileges
Execute a command line with conhost.exe as parent process
conhost.exe --headless {CMD}None of the 2 commands the identifier reads trips a Sigma process-creation rule. These commands and their descriptions are from LOLBAS’s entry for conhost.exe, by Wietze Beukema, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for conhost.exe. The identifier reads each with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.
What detects it
Is it the real conhost.exe?
C:\Windows\system32\10 known copies
10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\conhost.exe · signed by Microsoft Windows
27df0052dc30abf0c834b61c684ba8e11b4a480b308908267282dd2ed71ea89410.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\conhost.exe · signed by Microsoft Windows
22117361c2c34cb18beee2ca9770b3aa6c8d032a0941991454dd222bec6d929510.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\conhost.exe · signed by Microsoft Windows
57b0ccd3aebc6c7126e7c19f5dac492df51d904a505c5f5b0cb02270d53f868410.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\conhost.exe · signed by Microsoft Windows
7a9595b552e23fb058a698ed8201369eeecaee69bd3650ee1e9fe924e64c2be110.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\conhost.exe · signed by Microsoft Windows
a9b3185119953859889b462faf68d75df365ff569ee1b9a5c5ce1c26cb443cb910.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\conhost.exe · signed by Microsoft Windows
baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b6910.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\conhost.exe · signed by Microsoft Windows
697334c236cce7d4c9e223146ee683a1219adced9729d4ae771fd6a1502a6b6310.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\conhost.exe · signed by Microsoft Windows
912d217d9f34121bc6150a2d7f22b49d2c876942653348c671f358ff58af0eba10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\conhost.exe · signed by Microsoft Windows
046f7a1b4de67562547ed9a180a72f481fc41e803de49a96d7d7c731964d53a06.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\conhost.exe · not signed
f30686dd09b81d4080ab58def209173772fa132fa3762688274270afa6407872From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.