Hidden PowerShell from LNK Drops VBS/PS1 Toolkit to AppData

Ibrahim Saud@tektrix

•updated Sep 22, 2026•0•0•2

This rule detects instances where PowerShell is launched with hidden window arguments by explorer.exe or mshta.exe, and the command line indicates interactions with specific file extensions (.vbs, .ps1) located within the AppData directory. This pattern is often indicative of malicious script execution, such as those used in Konni malware campaigns to drop and execute payloads.