Skip to content

Hide Navigation Hide TOC

Powershell Executed From Headless ConHost Process (056c7317-9a09-4bd4-9067-d051312752ea)

Detects the use of powershell commands from headless ConHost window. The "--headless" flag hides the windows from the user upon execution.

Cluster A Galaxy A Cluster B Galaxy B Level
Powershell Executed From Headless ConHost Process (056c7317-9a09-4bd4-9067-d051312752ea) Sigma-Rules PowerShell - T1059.001 (970a3432-3237-47ad-bcca-7d8cbb217736) Attack Pattern 1
Powershell Executed From Headless ConHost Process (056c7317-9a09-4bd4-9067-d051312752ea) Sigma-Rules Windows Command Shell - T1059.003 (d1fcf083-a721-4223-aedf-bf8960798d62) Attack Pattern 1
PowerShell - T1059.001 (970a3432-3237-47ad-bcca-7d8cbb217736) Attack Pattern Command and Scripting Interpreter - T1059 (7385dfaf-6886-4229-9ecd-6fd678040830) Attack Pattern 2
Windows Command Shell - T1059.003 (d1fcf083-a721-4223-aedf-bf8960798d62) Attack Pattern Command and Scripting Interpreter - T1059 (7385dfaf-6886-4229-9ecd-6fd678040830) Attack Pattern 2