PowerShell Executed From Headless ConHost Process
Detects the execution of PowerShell commands from a headless ConHost process. The '--headless' flag is used to hide the console window from the user, which can be leveraged by adversaries for stealthy execution.
Sigma
