conhost.exe

Overview

conhost.exe (Console Window Host) is a Windows process responsible for hosting console applications and providing the interface between command-line programs and the Windows graphical environment.

Historically, console functionality was handled directly by csrss.exe. Modern Windows versions use conhost.exe to isolate console activity and improve both stability and security.

Expected Characteristics

Expected Location

Expected Parent

Common examples include:

Typical Profile

Why This Matters

conhost.exe itself is not typically the target of abuse.

However, attackers frequently use command-line tooling which naturally results in conhost.exe activity.

Because conhost.exe is associated with:

it often appears in process chains during investigations.

Anomalies involving conhost.exe can indicate:

Relevant ATT&CK Techniques

Investigation Objective

Determine:

In most cases, the parent process is more important than conhost.exe itself.

Normal Behaviour

Characteristics

Path

Signature

Parent Processes

Common examples include:

cmd.exe

powershell.exe

wsl.exe

ssh.exe

python.exe

legitimate administrative tools

Children

Lifetime

Typical Activity

Expected Behavioural Characteristics

conhost.exe:

Abuse Patterns

Path or Signature Mismatch

Investigate immediately if:

Examples include:

conhst.exe

conhost32.exe

conh0st.exe

Masquerading involving conhost.exe is common because the process is familiar to many administrators.

Suspicious Parent Processes

Investigate conhost.exe launched by:

These relationships frequently indicate phishing-driven execution chains.

Command-Line Abuse

Investigate conhost.exe associated with:

powershell.exe

cmd.exe

wscript.exe

cscript.exe

mshta.exe

particularly when:

Unexpected Child Processes

Although uncommon, investigate:

spawned directly from conhost.exe.

The parent console process is typically the primary execution context.

Injection Indicators

Investigate:

Attackers occasionally inject into console-related processes to evade detection.

Abnormal Volume

Investigate:

These may indicate automation, malware activity, or process-management problems.

Detection Opportunities

Parent Process Analytics

The strongest detection opportunities usually come from the parent process.

Investigate conhost.exe when associated with:

Particularly where execution patterns are uncommon for the environment.

Command-Line Visibility

Monitor:

These frequently surface through console-hosted processes.

Process Chain Analysis

Review:

Office
    → PowerShell
        → conhost.exe

or

Browser
    → cmd.exe
        → conhost.exe

These chains often provide stronger signals than conhost.exe alone.

Session Correlation

Correlate conhost.exe activity with:

The surrounding context usually determines legitimacy.

Hunting Opportunities

Useful hunting pivots include:

Focus on the workload being hosted rather than the console host itself.

False Positives

conhost.exe is present on most Windows systems and frequently appears during legitimate administration.

Common Legitimate Scenarios

Examples include:

Administrative Activity

Developers and administrators commonly generate conhost.exe activity through:

Context is critical.

Enterprise Tooling

Examples include:

These may legitimately create large numbers of console-hosted processes.

Validation Questions

Check:

Determine whether the observed workload is expected rather than focusing solely on conhost.exe.

Hardening Recommendations

Reduce Script Abuse Opportunities

Review controls relating to:

Many suspicious conhost.exe events originate from abuse of these technologies.

Application Control

Consider:

Prevent unauthorised command-line tooling from executing.

PowerShell Visibility

Enable:

Visibility into PowerShell activity often provides far more value than monitoring conhost.exe alone.

Process-Creation Monitoring

Maintain telemetry for:

This provides valuable context during investigations.

Administrative Governance

Review:

Reducing unnecessary console activity improves signal-to-noise ratios.

Defensive Validation

Regularly test:

Detection quality should be measured against realistic attack patterns.

Triage Checklist

Identity and Integrity

Parent Process Review

Behaviour Review

Scope and Context

Escalation Considerations

Escalate when:

ATT&CK References

Windows Processes

Command-Line Activity

MITRE ATT&CK