Suspicious PowerShell Execution via Office/Script Host Parent with Hidden/Encoded Flags

Ibrahim Saud@tektrix

•updated Jul 2, 2026•10•0•18

Detects the execution of PowerShell with hidden window or encoded command flags when initiated by common parent processes associated with document editors or scripting hosts, which is a common indicator of malicious macro-based or script-based attack chains.