Suspicious PowerShell WindowStyle Option (via ps_script)

title: Suspicious PowerShell WindowStyle Option (via ps_script)
id: 0f373ce0-d01c-53b5-ae6c-aef40923daa5
status: stable
description: This rule detects threat actors may use hidden windows to conceal hostile behavior from the plain sight of users. In some cases, windows that would usually be displayed when an application carries out an operation can be hidden
references:
    - https://attack.mitre.org/techniques/T1564/003/
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1564.003/T1564.003.md
author: Huntrule Team
date: 2026-01-28
tags:
    - attack.stealth
    - attack.t1564.003
logsource:
    product: windows
    category: ps_script
    definition: 'Requirements: Script Block Logging must be enabled'
detection:
    selection:
        ScriptBlockText|contains|all:
            - 'powershell'
            - 'WindowStyle'
            - 'Hidden'
    filter:
        ScriptBlockText|contains|all:
            - ':\Program Files\Amazon\WorkSpacesConfig\Scripts\'
            - '$PSScriptRoot\Module\WorkspaceScriptModule\WorkspaceScriptModule'
    condition: selection and not filter
falsepositives:
    - Unknown
level: medium