Headless Process Launched Via Conhost.EXE
Detects the launch of a child process via "conhost.exe" with the "--headless" flag. This flag is used to hide the console window from the user, which can be leveraged by adversaries for defense evasion to conceal malicious activity.
Sigma
