Headless Conhost Launching CMD
Detects instances where the headless console host (conhost.exe --headless) is used to launch a command shell. This technique is observed in the EtherRAT MSI loader to execute hidden batch scripts stealthily.
Microsoft Sentinel (KQL)
