Potemkin Loader - Hidden Window Parameter Enforcement

Ibrahim Saud@tektrix

•updated Jun 22, 2026•0•0•26

Detects PowerShell execution initiated by explorer.exe that explicitly uses the '-WindowStyle Hidden' parameter, a technique observed with the Potemkin loader to mask its execution.