Katz Stealer PowerShell Hidden Window Execution from Scripting Host
Detects PowerShell being executed with the '-WindowStyle Hidden' flag from a Windows Scripting Host parent process (wscript.exe or cscript.exe). This is a common technique used by malware, such as Katz Stealer, to run malicious scripts stealthily after being dropped by JavaScript.
Splunk (SPL)
