{"id":"056c7317-9a09-4bd4-9067-d051312752ea","title":"Powershell Executed From Headless ConHost Process","description":"Detects the use of powershell commands from headless ConHost window.\nThe \"--headless\" flag hides the windows from the user upon execution.\n","author":"Matt Anderson (Huntress)","status":"test","level":"medium","date":"2024-07-23","modified":"","tags":["attack.execution","attack.stealth","attack.t1059.001","attack.t1059.003","attack.t1564.003"],"technique_ids":["T1059.001","T1059.003","T1564.003"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Unknown"],"references":["https://www.huntress.com/blog/fake-browser-updates-lead-to-boinc-volunteer-computing-software"],"source_path":"rules/windows/process_creation/proc_creation_win_conhost_headless_powershell.yml","source_sha256":"55e32cee45f25b9d315202f915f37a59845c097a3807a7f45bfb15fb118df928","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_conhost_headless_powershell.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Powershell Executed From Headless ConHost Process\nid: 056c7317-9a09-4bd4-9067-d051312752ea\nrelated:\n    - id: 00ca75ab-d5ce-43be-b86c-55ff39c6abfc\n      type: derived\nstatus: test\ndescription: |\n    Detects the use of powershell commands from headless ConHost window.\n    The \"--headless\" flag hides the windows from the user upon execution.\nreferences:\n    - https://www.huntress.com/blog/fake-browser-updates-lead-to-boinc-volunteer-computing-software\nauthor: Matt Anderson (Huntress)\ndate: 2024-07-23\ntags:\n    - attack.execution\n    - attack.stealth\n    - attack.t1059.001\n    - attack.t1059.003\n    - attack.t1564.003\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_img:\n        - Image|endswith: '\\conhost.exe'\n        - OriginalFileName: 'CONHOST.EXE'\n    selection_cli:\n        CommandLine|contains|all:\n            - '--headless'\n            - 'powershell'\n    condition: all of selection_*\nfalsepositives:\n    - Unknown\nlevel: medium\nregression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_conhost_headless_powershell/info.yml\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1059.001","id":"T1059.001","name":"PowerShell","page":"techniques/enterprise/T1059.001/"},{"key":"enterprise/T1059.003","id":"T1059.003","name":"Windows Command Shell","page":"techniques/enterprise/T1059.003/"},{"key":"enterprise/T1564.003","id":"T1564.003","name":"Hidden Window","page":"techniques/enterprise/T1564.003/"}],"data_path":"data/detection-rules/056c7317-9a09-4bd4-9067-d051312752ea.json","kind":"sigma"}