Conhost Spawned By Suspicious Parent Process

Attackers frequently inject custom shell implementations into legitimate system processes to evade detection, bypass application allowlisting, and avoid using command interpreters like cmd.exe or PowerShell.exe. This technique involves spawning conhost.exe from unusual parent processes such as lsass.exe, services.exe, or explorer.exe. This behavior contrasts with typical scenarios where conhost.exe is initiated by legitimate command-line interfaces or applications. Monitoring process relationships for unusual parent-child connections is essential for identifying potential code injection attempts and malicious activities on Windows systems. This activity is considered high risk due to the potential for privilege escalation and defense evasion, allowing attackers to perform unauthorized actions with elevated privileges. The original Elastic detection rule was created on 2020/08/17 and updated on 2026/04/07.

Attack Chain

1. An attacker gains initial access to a Windows system through exploitation or social engineering.
2. The attacker injects malicious code into a legitimate system process such as lsass.exe, services.exe, or explorer.exe (Process Injection - T1055).
3. The injected code executes within the context of the compromised process.
4. The compromised process spawns conhost.exe, the Console Window Host (Execution via Command and Scripting Interpreter - T1059).
5. The spawned conhost.exe instance is used to execute arbitrary commands without typical auditing or security controls.
6. The attacker uses conhost.exe to perform reconnaissance, move laterally, or achieve persistence.
7. The attacker escalates privileges by leveraging the compromised process's elevated permissions (Privilege Escalation - TA0004).
8. The attacker achieves their final objective, such as data exfiltration, system compromise, or deploying ransomware.

Impact

Successful exploitation leads to arbitrary code execution within a legitimate system process, enabling attackers to perform malicious activities, escalate privileges, and evade detection. This can result in data theft, system compromise, and disruption of services. The masquerading of malicious activity within a trusted process makes detection challenging, potentially affecting numerous systems across an organization. If successful, attackers can bypass standard security measures and maintain a persistent presence on compromised systems.

Recommendation

• Deploy the Sigma rule "Conhost Spawned By Suspicious Parent Process" to your SIEM and tune for your environment to detect this specific parent/child process relationship.
• Investigate any instances of conhost.exe spawned by parent processes like lsass.exe, services.exe, or explorer.exe to determine legitimacy.
• Enable Sysmon process-creation logging to provide the necessary data for the Sigma rules above.
• Review and harden process whitelisting policies to prevent execution of unauthorized code.