LausivLoader: Hidden conhost --headless spawning encoded PowerShell

Ibrahim Saud@tektrix

•updated Sep 20, 2026•0•0•3

Detects the spawning of a hidden PowerShell process by wscript.exe via conhost.exe with the --headless argument. This pattern is characteristic of the LausivLoader malware, which utilizes obfuscated command-line arguments to execute hidden PowerShell scripts.