Hidden window
mediumWindowsSingle eventstablewindows.powershell.hidden_window · v1.0.0
What it detects
Detects PowerShell launched with a hidden window (-WindowStyle Hidden / -w hidden), a common way to keep malicious execution invisible to the logged-on user.
MITRE ATT&CK mapping
False positives and triage
Some deployment and monitoring tools hide their console windows. Correlate the parent process and account; recurring identical invocations from management tooling are usually benign.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 60%. Source: rules/windows/powershell_hidden_window.yaml, licensed under the Apache License 2.0.
id: windows.powershell.hidden_window
version: 1.0.0
status: stable
severity: medium
confidence: 0.6
platforms: [windows]
mitre_techniques: [T1059.001, T1564.003]
description: |
Detects PowerShell launched with a hidden window (-WindowStyle Hidden / -w hidden),
a common way to keep malicious execution invisible to the logged-on user.
match:
event_category_any: [script, process]
command_line_regex: "(?i)-w(indowstyle)?[ \t]+hidden"
false_positive_guidance: |
Some deployment and monitoring tools hide their console windows. Correlate the parent
process and account; recurring identical invocations from management tooling are usually
benign.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.