textinputhost.exe

TextInputHost.exe is a packaged (UWP) system app that presents the touch keyboard and the other modern text-input panels. It runs as the logged-on user, launched as part of the session, from a Windows SystemApps package folder rather than System32, and is signed by Microsoft. It works alongside ctfmon.exe, which handles the underlying text services.

Legitimately, TextInputHost is present on interactive desktops and suspended when not needed. It draws input UI rather than launching programs, so it does not normally start other processes or reach the network.

TextInputHost.exe is a baseline process. Its fixed identity, the logged-on user's account, a packaged Microsoft signature, no children, and no network, makes deviations easy to spot. The realistic abuse is impersonation (T1036.005), where malware borrows the name from a path outside the genuine packaged location.

As a persistent per-user process it could also be injected into (T1055). A TextInputHost that loads unusual modules, reaches the network, or spawns programs is acting outside its UI role.