GhostWeaver Headless Persistence Task

Tim Peck@timpeck

•updated Mar 9, 2026•1•0•49

Detects the execution of a scheduled task characteristic of the GhostWeaver RAT. The malware's persistence mechanism involves a hidden task that executes PowerShell via 'conhost --headless' and often uses a task name that mimics legitimate PowerShell cmdlets to blend in.