Suspicious PowerShell Hidden Window with Tar

Kaung Khant Ko@kaungkhantko

•updated Apr 9, 2026•0•113

Detects instances of PowerShell launching with a hidden window style and subsequently executing the 'tar' command to extract files into the LocalAppData directory, a pattern observed in Mustang Panda loaders.