Repeated ShowWindow SW_HIDE calls to conceal malicious process window

Emiliano Mema@Nosalva

•updated Jul 9, 2026•2•0•5

Detects multiple occurrences of processes initiating with a hidden window (SW_HIDE) flag within a short timeframe on the same device. This behavior is often associated with obfuscated script execution, persistence mechanisms, or malicious tools attempting to remain stealthy during execution.