PowerShell Hidden Window Execution

Kaung Khant Ko@kaungkhantko

•updated May 25, 2026•16•0•267

Detects PowerShell or pwsh.exe processes being launched with the '-windowstyle hidden' or '-w hidden' or '-window hidden' command-line arguments. This technique is often used by adversaries to conceal their activity from users.