PowerShell: Suspicious WindowStyle Hidden usage in script block text

title: "PowerShell: Suspicious WindowStyle Hidden usage in script block text"
id: 07291c94-8c82-4e11-9564-6f1082eb0534
status: test
description: This rule flags PowerShell script blocks that contain the combination of strings "powershell", "WindowStyle", and "Hidden", which indicates an attempt to run with a hidden window. Attackers may use hidden windows to conceal execution and reduce the likelihood of user-visible prompts or activity. It relies on Script Block Logging telemetry, matching the relevant terms within the ScriptBlockText and excluding a specific WorkSpacesConfig script path pattern.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1564.003/T1564.003.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_susp_windowstyle.yml
author: frack113, Tim Shelton (fp AWS), Huntrule Team
date: 2021-10-20
modified: 2023-01-03
tags:
  - attack.stealth
  - attack.t1564.003
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection:
    ScriptBlockText|contains|all:
      - powershell
      - WindowStyle
      - Hidden
  filter:
    ScriptBlockText|contains|all:
      - :\Program Files\Amazon\WorkSpacesConfig\Scripts\
      - $PSScriptRoot\Module\WorkspaceScriptModule\WorkspaceScriptModule
  condition: selection and not filter
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 313fbb0a-a341-4682-848d-6d6f8c4fab7c
    type: derived