Windows ConHost with Headless Argument

The analytic detects the unusual invocation of the Windows Console Host process (conhost.exe) with the undocumented `--headless` parameter. This activity is significant for a SOC as it is not commonly used in legitimate operations and may indicate an attacker's attempt to execute commands stealthily. If confirmed malicious, this behavior could lead to persistence, lateral movement, or other malicious activities, potentially resulting in data exfiltration or system compromise.