Skip to main content
uberAgent

Identifying Console Window Popups by Monitoring Process Starts

  • by Helge Klein
  • June 6, 2017

I recently noticed a console window pop up for a fraction of a second on my desktop. About an hour later, it happened again. Random windows appearing out of nowhere is not something I like to see on my machines. Read on to learn how I investigated the issue.

Monitoring Process Starts

Obviously, something was starting processes on my machine at a certain schedule. I wanted to find out what that was.

uberAgent, our user experience and application performance monitoring product, detects any process start on a monitored endpoint. Process starts are recorded with the exact timestamp, process name, PID, and the name of the parent process.

Detecting Console Process Starts

Identifying starts of console processes is easy if you have uberAgent. For every console process there is a console host child process called conhost.exe. All we need to do is look for conhost.exe processes and then list the names of the parent process. The following Splunk search does just that:

index=uberagent sourcetype=uberAgent:Process:ProcessStartup host=hkx1c ProcName=conhost.exe ProcParentName=* | table _time ProcParentName

Above search looks for process start events on my machine where the process name is conhost.exe. For every matching process start it lists the time the process was started and the name of the parent process. Please note that uberAgent’s configuration setting EnableExtendedInfo needs to be enabled in order for this to work. A listing of all sourcetypes and field names collected by uberAgent can be found here.

Finding the Console Process

When that offending console window popped up the next time I took note of the time and then ran the search from above. The result looked like this:

The console process started around the time I noticed the window pop-up was officebackgroundtaskhandler.exe. A while later I repeated the process, and again officebackgroundtaskhandler.exe turned up. So what’s the matter with this process apparently belonging to the Microsoft Office suite?

Why is officebackgroundtaskhandler.exe Flashing Console Windows?

A quick search for officebackgroundtaskhandler.exe led me to this Microsoft Answers post. Apparently the flashing console window is a know bug that will be fixed in a future update.

Phew, looks like this one is harmless and going to go away on its own. Unfortunately, that is not always the case. Make sure you understand the processes running on your machines. uberAgent can help with that.

About uberAgent

uberAgent is an innovative Windows and macOS user experience monitoring (UXM) and endpoint security analytics (ESA) product. UXM highlights include detailed information about boot and logon duration, application unresponsiveness detection, network reliability drill-downs, process startup duration, application usage metering, browser performance, web app metrics, and Citrix insights. ESA comes with a sophisticated activity monitoring engine, the uAQL query language, detection of risky activity, DNS query monitoring, hash calculation, registry monitoring, and Authenticode signature verification.

About vast limits

vast limits GmbH is the company behind uberAgent, the innovative user experience monitoring and endpoint security analytics product. vast limits’ customer list includes organizations from industries like finance, healthcare, professional services, and education, ranging from medium-sized businesses to global enterprises. vast limits’ network of qualified solution partners ensures best-in-class service and support anywhere in the world.

Comments

Your email address will not be published. Required fields are marked *