Analytics BIOC Low
✕

Conhost.exe spawned a suspicious cmd process

Attackers may abuse the conhost process to execute malicious files and evade detection.

Module:
Platform Analytics
Data source:
XDR Agent
ATT&CK tactics: Defense Evasion (TA0005)
ATT&CK techniques: System Binary Proxy Execution (T1218)
Detector tags: LOLBIN Execution Analytics
Attacker's goals:

Investigate the processes being spawned on the host for malicious activities.

Investigative actions:

An adversary may use the conhost process to evade detection.

Test period:
N/A (single event)
Deduplication:
1 Day
3 variations:
  • Conhost.exe spawned a suspicious powershell encoded command High (parent: Low)
  • Conhost.exe spawned a suspicious scripting process with long command line Medium (parent: Low)
  • Conhost.exe spawned a suspicious child process Medium (parent: Low)