Suspicious PowerShell Invocation Parameters

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•22

Detects suspicious PowerShell invocation command parameters such as encoded commands, hidden window styles, and non-interactive modes. These parameters are frequently used by adversaries to obfuscate malicious scripts, execute them stealthily, or prevent user interaction.