PowerShell Hidden Window with Suspicious Commands

Jorden Smith@Jorden

•updated Feb 10, 2026•3•0•18

Detects PowerShell execution where the window is hidden, combined with suspicious commands such as encoded payloads, direct execution of expressions (iex, Invoke-Expression), web requests (DownloadString, iwr, Invoke-WebRequest), base64 decoding (FromBase64String), or execution policy bypass. The rule specifically excludes legitimate application package management operations involving 'AppxPackage' and certain Visual Studio Code (VS Code) installer and process management activities.