Detection catalogue

Explore published rules with transparent provenance, licensing, and ATT&CK mappings.

detections

Loading detections…

Proxy Execution via Console Window Host

Identifies abuse of the Console Window Host (conhost.exe) to execute commands via proxy. This behavior is used as a defense evasion technique to blend-in malicious activity with legitimate Windows software.

ATT&CK coverage

Outside the enterprise matrix

Detection requirements

Log source category: event_index

What the source says

References

https://lolbas-project.github.io/lolbas/Binaries/Conhost/

Tagged by the source as

Data Source: CrowdstrikeData Source: Elastic DefendData Source: Elastic EndgameData Source: Microsoft Defender XDRData Source: SentinelOneData Source: SysmonData Source: Windows Security Event LogsDomain: EndpointOS: WindowsResources: Investigation GuideTactic: Defense EvasionUse Case: Threat Detection

Detection logic

Published to signed-in readers

The query as its source wrote it, its canonical form, and the content hash that pins this exact revision.