LOLBAS. GitHub
LIVING OFF THE LAND / OTHER MICROSOFT BINARIES

OpenConsole.exe

View source

Console Window host for Windows Terminal

Execute
01COMMAND EXAMPLES
01ATT&CK TECHNIQUES
01DETECTION RESOURCES
01CAPABILITIES
01 / TRADECRAFT

Command reference

1 examples

Execute1

EXAMPLE 01T1202

Execute specified process with OpenConsole.exe as parent process

COMMAND
OpenConsole.exe {PATH:.exe}
USE CASE
Use OpenConsole.exe as a proxy binary to evade defensive counter-measures
PRIVILEGES
User
OPERATING SYSTEM
Windows 10, Windows 11
Execute · EXE
02 / ON DISK

Known paths

C:\Program Files (x86)\Microsoft Visual Studio\2019\Community\Common7\IDE\CommonExtensions\Microsoft\Terminal\ServiceHub\os64\OpenConsole.exe
C:\Program Files (x86)\Microsoft Visual Studio\2019\Community\Common7\IDE\CommonExtensions\Microsoft\Terminal\ServiceHub\os86\OpenConsole.exe
C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\CommonExtensions\Microsoft\Terminal\ServiceHub\os64\OpenConsole.exe
C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.18.10301.0_x64__8wekyb3d8bbwe\OpenConsole.exe
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

1 resources

Indicators & detection notes

  • IOC

    OpenConsole.exe spawning unexpected processes

FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

Nasreddine Bencherchali@nas_bench