Hidden PowerShell downlod form github

F S@Fsdr

•updated Sep 14, 2026•6•0•16

This rule detects PowerShell processes executing with hidden window styles while performing web-based download operations from GitHub domains. It further identifies potential nested PowerShell execution, which is often used in obfuscated download-and-execute attack chains.