Minimized PowerShell Window Created

Daniel Koifman@Koifsec

•updated Mar 31, 2026•2•0•65

This rule detects the creation of a PowerShell or Pwsh process with its window style set to minimized. Adversaries often use this technique to hide their activities from the user, making it a potential indicator of malicious PowerShell execution.