Hidden PowerShell Execution Policy Bypass

Duo Tech@duotech

•updated Jun 3, 2026•4•0•10

Detects PowerShell being executed with execution policy bypass and hidden window styles. This specific combination, particularly with the '-f' parameter, was utilized by the empty.vbs script to launch Profile.ps1 in the Dragon Weave campaign.