Encoded/hidden PowerShell post recruitment-portal download

Ibrahim Saud@tektrix

•updated Jul 2, 2026•1•0•6

Detects the execution of PowerShell with flags indicating encoded commands (-enc) or hidden window styles (-windowstyle hidden), which are common techniques used to obfuscate malicious activity or run payloads stealthily. This behavior is often associated with the post-compromise execution phase of various threats, including payloads delivered via malicious portals.