Suspicious PowerShell Module Arguments: Encoded, Hidden Window, or Noninteractive

Alerts on PowerShell module executions using encoded commands, hidden windows, or noninteractive flags to evade visibility and interaction.

FreeUnreviewedSigmahighv1

suspicious-powershell-module-arguments-encoded-hidden-window-or-noninteractive-bbb80e91

title: "Suspicious PowerShell Module Arguments: Encoded, Hidden Window, or Noninteractive"
id: d868fced-3836-448d-a3a3-a9816f2075ec
related:
  - id: 3d304fda-78aa-43ed-975c-d740798a49c1
    type: derived
  - id: ed965133-513f-41d9-a441-e38076a0798f
    type: similar
  - id: bbb80e91-5746-4fbe-8898-122e2cafdbf4
    type: derived
status: test
description: This rule flags PowerShell module executions whose command-line context contains indicators of evasion or stealth, specifically encoded command usage, hidden window settings, or noninteractive execution flags. Attackers often rely on these parameters to obscure script content, reduce user visibility, or facilitate automated execution without prompts. It relies on available PowerShell module telemetry that includes ContextInfo so the rule can match the relevant argument patterns.
references:
  - Internal Research
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_module/posh_pm_susp_invocation_generic.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2017-03-12
modified: 2023-01-03
tags:
  - attack.execution
  - attack.t1059.001
logsource:
  product: windows
  category: ps_module
  definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b
detection:
  selection_encoded:
    ContextInfo|contains:
      - " -enc "
      - " -EncodedCommand "
      - " -ec "
  selection_hidden:
    ContextInfo|contains:
      - " -w hidden "
      - " -window hidden "
      - " -windowstyle hidden "
      - " -w 1 "
  selection_noninteractive:
    ContextInfo|contains:
      - " -noni "
      - " -noninteractive "
  condition: all of selection*
falsepositives:
  - Very special / sneaky PowerShell scripts
level: high
license: DRL-1.1

What it detects

This rule flags PowerShell module executions whose command-line context contains indicators of evasion or stealth, specifically encoded command usage, hidden window settings, or noninteractive execution flags. Attackers often rely on these parameters to obscure script content, reduce user visibility, or facilitate automated execution without prompts. It relies on available PowerShell module telemetry that includes ContextInfo so the rule can match the relevant argument patterns.

Known false positives

Very special / sneaky PowerShell scripts

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.