huntrule

Suspicious Hidden Encoded PowerShell Execution

PremiumReviewedSigma · Medium · v1
Product
windows
Category
process_creation
Author
HuntRule
Published
2026-10-20
Updated
2026-10-20
AnalysisDetection

ATT&CK techniques

Execution

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule detects PowerShell launched with a hidden window, bypassed execution policy, and a base64-encoded command. This behavior matches the BlackSuit intrusion chain where operators run obfuscated encoded payloads to stage tooling while evading logging. The combination of hidden execution and encoding is a common obfuscation pattern used to conceal malicious in-memory activity.

Reporting behind it

Related detections9 linkedT1059.001 — drag to rearrange
Malicious PowerShell Download Cradle Spawned by Quick Assist
Suspicious ClickFix RunMRU Entry Recording LOLBIN Command from Run Dialog
Suspicious Data Exfiltration to webhook.site via PowerShell Invoke-WebRequest (via ps_script)
Suspicious PowerShell Download and Execute via iwr Piped to iex
Suspicious ScreenConnect Remote Access Client Spawning PowerShell (via process_creation)
Suspicious APT42 SMB Share Discovery via Invoke-HuntSMBShares (via ps_script)
Suspicious Scheduled Task Launching rundll32 DLL via Ransomware
Suspicious Child Process Spawned by Triofox GladinetCloudMonitor
Suspicious PowerShell Loader Spawned by mshta via UNC5142 ClickFix
Suspicious Hidden Encoded PowerShell Execution
Pivot detection · T1059.001 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.