Console Window host
conhost.exe --headless calc.exe
Execute calc.exe with conhost.exe as parent process
Specify --headless parameter to hide child process window (if applicable)
c:\windows\system32\conhost.exe
IOC: conhost.exe spawning unexpected processes, Sigma: https://github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_conhost_susp_child_process.yml
Adam (@hexacorn), Wietze (@wietze)