LOLBAS. GitHub
LIVING OFF THE LAND / OS BINARIES

Conhost.exe

View source

Console Window host

Execute
02COMMAND EXAMPLES
01ATT&CK TECHNIQUES
01DETECTION RESOURCES
01CAPABILITIES
01 / TRADECRAFT

Command reference

2 examples

Execute2

EXAMPLE 01T1202

Execute a command line with conhost.exe as parent process

COMMAND
conhost.exe {CMD}
USE CASE
Use conhost.exe as a proxy binary to evade defensive counter-measures
PRIVILEGES
User
OPERATING SYSTEM
Windows 10, Windows 11
Execute · CMD
EXAMPLE 02T1202

Execute a command line with conhost.exe as parent process

COMMAND
conhost.exe --headless {CMD}
USE CASE
Specify --headless parameter to hide child process window (if applicable)
PRIVILEGES
User
OPERATING SYSTEM
Windows 10, Windows 11
Execute · CMD
02 / ON DISK

Known paths

c:\windows\system32\conhost.exe
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

1 resources

Indicators & detection notes

  • IOC

    conhost.exe spawning unexpected processes

FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

Adam@hexacorn
Wietze@wietze