PowerShell Hidden WindowStyle Indicator in Script Block Text (Windows)

ATT&CK techniques

Defense Evasion

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
- T1564.003Hidden Window
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags PowerShell script block content that includes the terms "powershell", "WindowStyle", and "Hidden", which can indicate an attempt to run with a concealed window. Attackers may use hidden windows to reduce user visibility while executing actions on a host. The detection relies on Script Block Logging telemetry and matches on ScriptBlockText substring content, excluding matches that contain specific Amazon WorkSpaces-related script paths.

Reporting behind it

Related detections9 linkedT1564.003 — drag to rearrange

Suspicious Script Host Spawning Hidden PowerShell (via process_creation)

Conhost Suspicious Command Execution

Suspicious conhost Headless Execution for Hidden Window

Windows cmd.exe Executing start Utility with Hidden Window Flags (/b or /min)

PowerShell Launch With --headless From Conhost.exe on Windows

Windows: Headless Chromium Browser Execution via --headless

Windows Chromium-Based Browsers Launched with Headless Debugging and User Profile Directory

Windows PUA AdvancedRun.exe Execution

Windows Process Creation: Headless Chromium Download via dump-dom

PowerShell Hidden WindowStyle Indicator in Script Block Text (Windows)

Pivot detection · T1564.003 · 9 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

powershell-suspicious-windowstyle-hidden-usage-in-script-block-text-313fbb0a

title: PowerShell Hidden WindowStyle Indicator in Script Block Text (Windows)
id: 07291c94-8c82-4e11-9564-6f1082eb0534
status: test
description: This rule flags PowerShell script block content that includes the terms "powershell", "WindowStyle", and "Hidden", which can indicate an attempt to run with a concealed window. Attackers may use hidden windows to reduce user visibility while executing actions on a host. The detection relies on Script Block Logging telemetry and matches on ScriptBlockText substring content, excluding matches that contain specific Amazon WorkSpaces-related script paths.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1564.003/T1564.003.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_susp_windowstyle.yml
author: frack113, Tim Shelton (fp AWS), Huntrule Team
date: 2021-10-20
modified: 2023-01-03
tags:
  - attack.stealth
  - attack.t1564.003
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection:
    ScriptBlockText|contains|all:
      - powershell
      - WindowStyle
      - Hidden
  filter:
    ScriptBlockText|contains|all:
      - :\Program Files\Amazon\WorkSpacesConfig\Scripts\
      - $PSScriptRoot\Module\WorkspaceScriptModule\WorkspaceScriptModule
  condition: selection and not filter
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 313fbb0a-a341-4682-848d-6d6f8c4fab7c
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL