Conhost Headless Execution via Pcalua (GOLD BLADE’s)

Ankit Mehta@Secvyn

•updated Jun 29, 2026•1•0•2

Detects the execution of 'conhost.exe' with the '--headless' argument, specifically when initiated by 'pcalua.exe'. This combination has been observed in attacks by the GOLD BLADE threat group for indirect command execution.