Hidden Windows Process Execution via PowerShell
Detects the use of the PowerShell 'Start-Process' cmdlet with parameters ('-WindowStyle Hidden', '-NoNewWindow') to execute a process without a visible window. This specific execution pattern was used by the Windows payload (msinit.exe) of the 'ambar-src' malware to evade user detection.
Microsoft Sentinel (KQL)
