UNC1549 hidden/encoded PowerShell execution post payload download

Ibrahim Saud@tektrix

•updated Jul 2, 2026•3•0•9

Detects the execution of PowerShell with flags commonly used to obfuscate command lines or hide activity from the user, such as -EncodedCommand or -WindowStyle Hidden. These techniques are frequently used by adversaries to execute malicious scripts while avoiding detection.