Suspicious PowerShell WindowStyle Hidden Option
This rule detects PowerShell script execution where the 'WindowStyle Hidden' option is used. Adversaries often use this technique to conceal malicious activity from users by preventing the PowerShell window from being visible. The rule specifically looks for the combination of 'powershell', 'WindowStyle', and 'Hidden' within the script block text. A filter is applied to exclude legitimate Amazon WorkSpaces configuration scripts that use this option.
Sigma
