huntrule

Suspicious PowerShell Console Window Hiding via ShowWindow

PremiumReviewedSigma · Medium · v1
Product
windows
Category
ps_script
Author
HuntRule
Published
2026-08-09
Updated
2026-08-28
AnalysisDetection

ATT&CK techniques

Execution

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule detects PowerShell resolving GetConsoleWindow and calling ShowWindow to hide its own console, a stealth technique in the fake AI-tool installer chain that also re-executes itself for UAC. Hiding the window keeps the malicious script invisible to the user while it stages ransomware components in the background.

Reporting behind it

Related detections9 linkedT1059.001 — drag to rearrange
Suspicious node.exe Execution Spawned by PowerShell
Suspicious PowerShell Spawned by mshta.exe in FakeSG Chain (via process_creation)
Suspicious Encoded PowerShell Using Base64 Stream Decompression Routines (via process_creation)
Malicious IIS Worker Process Spawning Command Shell for Webshell Reconnaissance (via process_creation)
Suspicious PowerShell Spawned by Windows Script Host during Scarlet Goldfinch Infection (via process_creation)
Suspicious PowerShell Launched by MSIX StartingScriptWrapper From WindowsApps via Process Creation (via process_creation)
Malicious Command Shell or PowerShell Spawned by Tomcat via Process Creation (via process_creation)
Suspicious PowerShell Download Cradle via IEX and DownloadString (via process_creation)
Suspicious Hidden PowerShell Spawned by MSHTA for Boot Persistence (via process_creation)
Suspicious PowerShell Console Window Hiding via ShowWindow
Pivot detection · T1059.001 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.