UNC1549 PowerShell staging spawned from Office/browser with hidden window or encoded command

Ibrahim Saud@tektrix

•updated Jul 2, 2026•7•0•9

Detects instances where common productivity (e.g., Office) or web browser applications spawn PowerShell.exe with suspicious command-line arguments often associated with malicious script execution or obfuscated code downloaders, such as '-w hidden', '-nop', or '-enc'.