conhost.exe: Windows Processes

Normal Profile

These are the values a genuine copy shows. Treat any value that differs as a lead.

Parent: The console program it serves (a value that published detection rules check for)Source: SigmaHQ: Conhost Spawned By Uncommon Parent Process (opens in a new tab)Windows Terminal hosts its prompts through OpenConsole.exe, its own build of the console host.
Path: System32C:\Windows\System32\conhost.exeSources: Microsoft Learn: Windows Console and Terminal Ecosystem Roadmap (opens in a new tab), Velociraptor: Windows.Attack.UnexpectedImagePath (opens in a new tab), SigmaHQ: System File Execution Location Anomaly (opens in a new tab)
Account: Compare its account with that of the console program it serves, on a clean machine of the same build.
Session: Read each copy's SessionId on a clean machine of the same build, services and tasks included.
Instances: One per consoleSources: Microsoft Learn: Creation of a Console (opens in a new tab), Windows Console and Terminal Ecosystem Roadmap (opens in a new tab), Windows Command Line blog: Windows Command-Line: Inside the Windows Console (opens in a new tab)Programs started from a prompt share its console, so they add no console host of their own.
Starts: When a console program starts with a new consoleSource: Microsoft Learn: Creation of a Console (opens in a new tab)
Command Line: Read it elevated with Get-CimInstance Win32_Process on a clean machine of the same build.
Signed By: Check the catalogue signature as well as the file's own, because Velociraptor notes that conhost.exe can show as unsigned.

A value that published detection rules check for.No public source states this value, so compare with a clean machine of the same Windows build.

Why It Matters

A console host with an uncommon parent, such as lsass.exe or services.exe, can point to code injected into that parent. Its memory can also hold the console's text and command history.

What It Does

The console host serves the console API for command-line programs and draws their window. Windows keeps it in the system folder as conhost.exe, and its open-source build is OpenConsole.exe. The system creates a console when it starts a console program such as cmd.exe, and by default a program started from a prompt inherits that prompt's console instead of getting its own. So expect one conhost.exe per console, with the program that opened the console as its parent. It holds what the console shows, so its memory can keep the text and commands of a session. A console host under a core process such as lsass.exe or services.exe, outside System32, or starting programs of its own is the one to check.

SigmaHQ flags a console host started by an uncommon parent, such as lsass.exe, services.exe, smss.exe, spoolsv.exe, wininit.exe or winlogon.exe, as a possible sign of code injected into that parent. Elastic flags any child of conhost.exe other than the .NET optimisation service and the Windows error reporting tools.

On Windows 11 version 22H2 and later, Windows Terminal is the default for command-line programs unless someone chose another terminal. It talks to them through OpenConsole.exe, so a prompt's console host may be OpenConsole.exe, not conhost.exe.

In memory, windows.consoles reads the console buffers conhost.exe holds and windows.cmdscan finds command history, so a capture can show what was typed and printed.

How Attackers Abuse It

Each line is a way this process is misused, with the page that shows how to spot it.

A console host under lsass.exe or services.exe can mean code running inside that parent, and SigmaHQ's rule flags it.Remote Thread Injection
Malware takes the name conhost.exe and runs outside System32, one more console host among the genuine ones.Wrong Path

In the Process Tree

These are the rows of the process list that this page explains.

conhost.exeConsole Window Host for the person's promptNot alwaysWith the classic console window. Windows Terminal, the default from Windows 11 version 22H2, uses its own OpenConsole.exe insteadOpen it in the tree: conhost.exe

On ws-042, 12 Oct 2026

conhost.exeConsole Window Host for the SYSTEM promptOpen it in the tree: conhost.exe

Red Flags

Each sign below links to the page that shows how to confirm it.

A parent that SigmaHQ calls uncommon, such as lsass.exe, services.exe, smss.exe, spoolsv.exe or winlogon.exe.Wrong Parent
A console host under a core process can mean code running inside that process.Remote Thread Injection
Any folder but C:\Windows\System32.Wrong Path
A conhost.exe with no valid signature, embedded or through a catalogue. Velociraptor notes it can look unsigned.Renamed, Unsigned or Falsely Signed Binaries

How to Check It

Each page shows how to check this process, on a running machine and in a memory image.

What Records It

Each record names its log and what must be switched on to get it.

Record and Where It Lands	What to Read	How to Turn It On
4688 `A new process has been created` (opens in a new tab)`Security`It is written on the computer the process ran on.	For New Process Name conhost.exe, the Creator Process Name should be a console program. SigmaHQ flags lsass.exe or services.exe.Process Trees and Call Chains shows how to read it.	Turn on Audit Process Creation. For the command line, also turn on Include command line in process creation events.
1 `Process creation` (opens in a new tab)`Microsoft-Windows-Sysmon/Operational`It is written on any Windows computer running Sysmon.	Image conhost.exe with its ParentImage and ParentCommandLine.Process Trees and Call Chains shows how to read it.	Run Sysmon with ProcessCreate events in its configuration.
`DeviceProcessEvents` (opens in a new tab)Each row is a process creation or a related event, naming the new process, the process that created it and that creator's parent.Defender XDR, advanced hunting	FileName conhost.exe with its InitiatingProcessFileName, the program it serves.	The Defender for Endpoint sensor on the device

Hunt It

The same hunt is written for four tools, so pick the one you use. Defender XDR and Sentinel queries are in KQL, which you paste into Advanced hunting in the Defender portal or into Sentinel's Logs page. Splunk queries are in SPL, for its Search page, and Velociraptor queries are in VQL, which you run as a hunt.

Sees It DirectlyDeviceProcessEvents

Reads the DeviceProcessEvents table in Defender XDR advanced hunting, from devices onboarded to Defender for Endpoint. A hit is a lead to check that parent for code running inside it. SigmaHQ's rule also lists explorer.exe and most svchost.exe copies, to add once you know your own noise.

KQLDefender XDR, Advanced hunting

// conhost.exe outside System32, or started by a parent SigmaHQ calls uncommonDeviceProcessEvents| where Timestamp > ago(30d)| where FileName =~ "conhost.exe"| where not(FolderPath matches regex @"(?i)^C:\\Windows\\System32(\\conhost\.exe)?$")    or InitiatingProcessFileName in~ ("lsass.exe", "services.exe", "smss.exe", "spoolsv.exe", "wininit.exe", "winlogon.exe", "userinit.exe", "regsvr32.exe", "rundll32.exe")| project Timestamp, DeviceName, FolderPath, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine

Changes by Version

This process has changed between versions, so read a machine against its own.

Windows 7 The console moved out of csrss.exe into its own host process, conhost.exe.
Windows 11 version 22H2 Windows Terminal became the default, talking to command-line programs through OpenConsole.exe.

Check It in the Registry: Command Processor AutoRun