starred/terminal
1
0
Fork 0
mirror of https://github.com/microsoft/terminal.git synced 2026-02-03 21:25:34 +00:00
Code Issues 19.0k Packages Projects Releases 20 Wiki Activity

Bug Report - Azure Security Center Flags Windows Terminal launching conhost as Suspicious #4761

New Issue
Closed
opened 2026-01-30 23:55:55 +00:00 by claunia · 1 comment
claunia commented 2026-01-30 23:55:55 +00:00
Owner
Copy Link

Originally created by @ld0614 on GitHub (Nov 1, 2019).

Originally assigned to: @DHowett-MSFT on GitHub.

I noticed after connecting my computer up to a Log Analytics account in Azure that I started getting alerts from Azure Security Center about Windows Terminal launching conhost. This might be a duplicate of #2568 but might just be related.

I am running version 0.6.2951.0 downloaded and installed from the Microsoft Store.

Alert Details

DESCRIPTION The system process c:\program files\windowsapps\microsoft.windowsterminal_0.6.2951.0_x64__8wekyb3d8bbwe\conhost.exe was observed running in an abnormal context. Malware often use this process name to masquerade its malicious activity.
ACTIVITY TIME Thursday, October 31, 2019, 9:36:12 AM
SEVERITY Medium
STATE Active
DETECTED BY Microsoft
ENVIRONMENT Non-Azure
RESOURCE TYPE Non-Azure Resource
COMMAND LINE conhost.exe --headless --width 120 --height 27 --signal 0x7b8 -- pwsh.exe
PARENT PROCESS windowsterminal.exe
PROCESS ID 0x54b4
PARENT PROCESS ID 0x9dd4
SYSTEM PROCESS CONHOST.EXE

Originally created by @ld0614 on GitHub (Nov 1, 2019). Originally assigned to: @DHowett-MSFT on GitHub. I noticed after connecting my computer up to a Log Analytics account in Azure that I started getting alerts from Azure Security Center about Windows Terminal launching conhost. This might be a duplicate of #2568 but might just be related. I am running version 0.6.2951.0 downloaded and installed from the Microsoft Store. ## Alert Details ## DESCRIPTION The system process c:\program files\windowsapps\microsoft.windowsterminal_0.6.2951.0_x64__8wekyb3d8bbwe\conhost.exe was observed running in an abnormal context. Malware often use this process name to masquerade its malicious activity. ACTIVITY TIME Thursday, October 31, 2019, 9:36:12 AM SEVERITY Medium STATE Active DETECTED BY Microsoft ENVIRONMENT Non-Azure RESOURCE TYPE Non-Azure Resource COMMAND LINE conhost.exe --headless --width 120 --height 27 --signal 0x7b8 -- pwsh.exe PARENT PROCESS windowsterminal.exe PROCESS ID 0x54b4 PARENT PROCESS ID 0x9dd4 SYSTEM PROCESS CONHOST.EXE
claunia added the Needs-Tag-FixTracking-External labels 2026-01-30 23:55:55 +00:00
claunia commented 2026-01-30 23:55:55 +00:00
Author
Owner
Copy Link

@DHowett-MSFT commented on GitHub (Jan 24, 2020):

This is likely largely no longer an issue since we stopped calling it conhost.exe. Let me know if it's still flagging!

@DHowett-MSFT commented on GitHub (Jan 24, 2020): This is likely largely no longer an issue since we stopped calling it `conhost.exe`. Let me know if it's still flagging!
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
⛺ Reserved
A11yCO
A11yMAS
A11ySev1
A11ySev2
A11ySev3
A11yTTValidated
A11yUsable
A11yVoiceAccess
A11yWCAG
Area-Accessibility
Area-AtlasEngine
Area-AzureShell
Area-Build
Area-Build
Area-Chat
Area-CmdPal
Area-CodeHealth
Area-Commandline
Area-CookedRead
Area-DefApp
Area-Extensibility
Area-Fonts
Area-GroupPolicy
Area-i18n
Area-Input
Area-Interaction
Area-Interop
Area-Localization
Area-Output
Area-Performance
Area-Portable
Area-Quality
Area-Remoting
Area-Rendering
Area-Schema
Area-Server
Area-Settings
Area-SettingsUI
Area-ShellExtension
Area-ShellExtension
Area-ShellExtension
Area-Suggestions
Area-Suggestions
Area-TerminalConnection
Area-TerminalControl
Area-Theming
Area-UserInterface
Area-VT
Area-Windowing
Area-WPFControl
AutoMerge
Blocking-Ingestion
Culprit-Centennial
Culprit-WinUI
Disability-All
Disability-Blind
Disability-LowVision
Disability-Mobility
External-Blocked-WinUI3
Fixed
Gathering-Data
good first issue
HCL-E+D
HCL-WindowsTerminal
Help Wanted
Impact-Compatibility
Impact-Compliance
Impact-Correctness
Impact-Visual
In-PR
InclusionBacklog
InclusionBacklog-Windows TerminalWin32
InclusionCommitted-202206
Issue-Bug
Issue-Docs
Issue-Feature
Issue-Feature
Issue-Question
Issue-Samples
Issue-Scenario
Issue-Task
Needs-Attention
Needs-Author-Feedback
Needs-Bisect
Needs-Discussion
Needs-Repro
Needs-Tag-Fix
Needs-Tag-Fix
Needs-Triage
No-Recent-Activity
Priority-0
Priority-1
Priority-2
Priority-3
Product-Cmd.exe
Product-Colortool
Product-Colortool
Product-Colortool
Product-Conhost
Product-Conpty
Product-Meta
Product-Powershell
Product-Terminal
Product-WSL
pull-request
Mirrored from GitHub Pull Request
 Resolution-Answered
Resolution-By-Design
Resolution-Duplicate
Resolution-External
Resolution-Fix-Available
Resolution-Fix-Committed
Resolution-No-Repro
Resolution-Won't-Fix
Severity-Blocking
Severity-Crash
Severity-DataLoss
spam
this-will-be-a-breaking-change
Tracking-External
WindowsTerminal_Win32
Work-Item
zAskModeBug
zInbox-Bug
No Label Needs-Tag-Fix Tracking-External
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
claunia
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/terminal#4761
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?