It is normal to see conhost.exe being launched at nearly the same time as a command line interface tool or interpreter, such as CMD and PowerShell, is launched. The conhost process acts somewhat as a buffer for command line commands, much like bash history on a Unix/Linux system. However, in order to view command line history of a process, one must dump and inspect the memory space of the corresponding conhost.exe process. Given the nature of conhost.exe, it could be a useful analytic to examine which processes launch conhost.exe and inspecting which of those are not expected command line interpreters. This could behaviorally reveal malicious shells being used by attackers.