Detection of Suspicious PowerShell WindowStyle Hidden Usage

Adversaries frequently employ the PowerShell -WindowStyle Hidden parameter to execute malicious scripts while minimizing the visible footprint on the target system. By suppressing the appearance of the PowerShell console window, attackers can conduct background operations, such as downloading and executing payloads, credential dumping, or lateral movement, without alerting the active user. This behavior is a common component of various post-exploitation toolkits and persistent threats. Defenders should focus on Script Block Logging (Event ID 4104) to capture and inspect the specific commands executed within PowerShell, as attackers often attempt to blend these commands into legitimate administrative or automation scripts.

Impact

Successful abuse of hidden window execution allows attackers to maintain stealth during the execution of malicious code. If undetected, this can lead to full system compromise, data exfiltration, or the establishment of long-term persistence in the target environment, significantly reducing the probability of immediate user-driven incident response.

Recommendation

Detection engineering teams should focus on identifying PowerShell script blocks containing the combination of WindowStyle and Hidden keywords.

• Enable PowerShell Script Block Logging (Event ID 4104) across the environment to provide the visibility required for the Sigma rule below.
• Deploy the provided Sigma rule to your SIEM and tune it against known administrative automation scripts that legitimately use the Hidden parameter.
• Investigate any hits from this rule to determine if the originating process is a standard deployment script or an unauthorized malicious actor.