Suspicious PowerShell from IDE

Tim Peck@timpeck

•updated Jan 26, 2026•7•0•190

Detects PowerShell processes spawned by Visual Studio Code or Cursor IDEs that use suspicious flags like '-WindowStyle Hidden' and commands typical of download cradles. This behavior is associated with malicious extensions that execute second-stage payloads.