Conhost.exe spawned a suspicious cmd process

Cortex XSIAM Analytics Alert Reference by Alert name

Product

Cortex XSIAM

Last date published

2025-01-19

Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	Requires: XDR Agent
Detection Modules
Detector Tags
ATT&CK Tactic	Defense Evasion (TA0005)
ATT&CK Technique	System Binary Proxy Execution (T1218)
Severity	Low

Attackers may abuse the conhost process to execute malicious files and evade detection.

Investigate the processes being spawned on the host for malicious activities.

An adversary may use the conhost process to evade detection.

ATT&CK Tactic	Defense Evasion (TA0005)
ATT&CK Technique	System Binary Proxy Execution (T1218)
Severity	Medium

Attackers may abuse the conhost process to execute malicious files and evade detection.

Investigate the processes being spawned on the host for malicious activities.

An adversary may use the conhost process to evade detection.