Powershell Executed From Headless ConHost Process

SigmaHQ Detections@sigmaHQ

•updated Apr 28, 2026•5•0•2

Detects the use of powershell commands from headless ConHost window. The "--headless" flag hides the windows from the user upon execution.