Hidden PowerShell EncodedCommand via conhost.exe --headless

Ibrahim Saud@tektrix

•updated Sep 20, 2026•3•0•7

Detects instances where WScript or CScript (Windows Script Host) spawns PowerShell with common obfuscation and persistence flags, specifically executing in a hidden, non-interactive, headless, and encoded command mode. This pattern is commonly used by malicious scripts (e.g., VBScript or JScript) to execute secondary payloads while minimizing visual indicators on the host.