Suspicious PowerShell WindowStyle Option
Last updated on:
In this page
About the rule
Rule Type
Standard
Rule Description
Adversaries may use hidden windows to conceal malicious activity from the plain sight of users. In some cases, windows that would typically be displayed when an application carries out an operation can be hidden
Severity
Trouble
Rule Requirement
Criteria
Action1: actionname = "PowerShell Script Block Logged" AND (SCRIPTEXECUTED contains "powershell" AND SCRIPTEXECUTED contains "WindowStyle" AND SCRIPTEXECUTED contains "Hidden") AND (SCRIPTEXECUTED notcontains ":\Program Files\Amazon\WorkSpacesConfig\Scripts" OR SCRIPTEXECUTED notcontains "$PSScriptRoot\Module\WorkspaceScriptModule\WorkspaceScriptModule") select Action1.HOSTNAME,Action1.MESSAGE,Action1.SCRIPTEXECUTED
Detection
Execution Mode
realtime
Log Sources
Windows
Author
frack113, Tim Shelton (fp AWS)
