Suspicious Headless Conhost Deno Execution

Duo Tech@duotech

•updated Jun 1, 2026•0•0•6

Detects the use of `conhost.exe` with the `--headless` flag to stealthily execute the Deno runtime (`deno.exe`). This technique is utilized by the DinDoor backdoor to establish hidden persistence on compromised endpoints.