Hidden-window PowerShell execution of cap.ps1

Duo Tech@duotech

•updated Jul 2, 2026•0•0•0

Detects the execution of a PowerShell script named 'cap.ps1' using common obfuscation and evasion flags including '-windowstyle hidden' and '-executionpolicy bypass'. This pattern is frequently used by adversaries to execute malicious scripts while minimizing user visibility and bypassing standard security policy restrictions.