Dropping Elephant LNK Proxy Execution via conhost.exe Spawning PowerShell Downloader

Ankit Mehta@Secvyn

•updated Jun 29, 2026•0•0•1

Detects the execution of PowerShell with suspicious download-related commands (Invoke-WebRequest, DownloadFile, WebClient, IEX, DownloadString) when initiated through conhost.exe, specifically when the originating parent process is a common shell or utility associated with shortcut (.lnk) file execution or specific command patterns.