Powershell Executed From Headless ConHost Process — Detection Rule

Detects the use of powershell commands from headless ConHost window. The "--headless" flag hides the windows from the user upon execution.

Read the full analysis on IntelFusions