Silent Node.js Execution via Conhost Headless

nomit vyas@xoxo

•updated Jun 24, 2026•2•1•19

Detects the use of conhost.exe with the --headless flag to execute Node.js payloads silently. This technique is used by EtherRAT to run its malicious JavaScript payloads without displaying a console window to the user, aiding in defense evasion.