All Detections

Powershell Executed From Headless ConHost Process

Yamato Security Hayabusa@YamatoSecurityHayabusa
updated Jun 24, 202509

Detects the use of powershell commands from headless ConHost window. The "--headless" flag hides the windows from the user upon execution.

Sigma