PowerShell launched with a hidden window style

Siemphony@siemphonylowT1564.003unverifiedPlaybook · Defence evasion

This strategy carries three per-platform analytics — AN0360 (Windows), AN0361 (Linux), AN0362 (macOS) — and only the Windows one names a literal, single-event observable: MITRE's own example in the technique description, powershell.exe -WindowStyle Hidden. AN0361 describes X11/Wayland calls and DISPLAY-variable manipulation that leave no trace in the auditd sources the brief lists (EXECVE/SYSCALL argv carries no windowing API), and AN0362 is a plist-modification-plus-correlation pattern spanning multiple events. Both would need invented fields to reach with a single Sigma selection, so only the Windows leg is built here. This rule matches PowerShell or pwsh invoked with -WindowStyle (or the -Win abbreviation PowerShell itself accepts) set to Hidden, using windash so a hyphen- or slash-prefixed switch is caught the same way. MITRE's ParentProcessCorrelation knob — narrowing to unexpected parent processes — is named in the analytic but not applied here, because doing so would mean inventing a parent-process allowlist with no basis in the brief; as written the rule is broader than the technique and flags every hidden PowerShell launch, malicious or administrative alike. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0128, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

1title: PowerShell launched with a hidden window style2id: 445b1c57-564c-427f-a65d-fbff52fad79e3status: experimental4description: |5  This strategy carries three per-platform analytics — AN0360 (Windows),6  AN0361 (Linux), AN0362 (macOS) — and only the Windows one names a literal,7  single-event observable: MITRE's own example in the technique description,8  powershell.exe -WindowStyle Hidden. AN0361 describes X11/Wayland calls and9  DISPLAY-variable manipulation that leave no trace in the auditd sources the10  brief lists (EXECVE/SYSCALL argv carries no windowing API), and AN0362 is a11  plist-modification-plus-correlation pattern spanning multiple events. Both12  would need invented fields to reach with a single Sigma selection, so only13  the Windows leg is built here. This rule matches PowerShell or pwsh invoked14  with -WindowStyle (or the -Win abbreviation PowerShell itself accepts) set15  to Hidden, using windash so a hyphen- or slash-prefixed switch is caught the16  same way. MITRE's ParentProcessCorrelation knob — narrowing to unexpected17  parent processes — is named in the analytic but not applied here, because18  doing so would mean inventing a parent-process allowlist with no basis in19  the brief; as written the rule is broader than the technique and flags20  every hidden PowerShell launch, malicious or administrative alike.21  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0128, not hand-written and not tested by its author. Any lab result is on this rule's own page.22references:23  - https://attack.mitre.org/techniques/T1564/00324  - https://attack.mitre.org/detectionstrategies/DET012825author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)26date: 2026-08-1727tags:28  - attack.defense-evasion29  - attack.t1564.00330logsource:31  category: process_creation32  product: windows33detection:34  selection_tool:35    Image|endswith:36      - '\powershell.exe'37      - '\pwsh.exe'38  selection_hidden:39    CommandLine|contains|windash:40      - '-windowstyle hidden'41      - '-windowstyle h'42      - '-win hidden'43      - '-win h'44  condition: selection_tool and selection_hidden45falsepositives:46  - "RMM, patch-management and software-deployment tooling — SCCM, Intune, PDQ and most commercial RMM agents — that wraps its payload scripts in powershell.exe -WindowStyle Hidden by convention so an unattended job never flashes a console at a logged-in user; this is an industry-standard pattern and by far the loudest source of matches here."47  - "Logon and scheduled-task scripts pushed by Group Policy that call PowerShell with a hidden window so a maintenance task does not interrupt the desktop, which is exactly the legitimate administrative use the technique description itself names."48  - "Developers and power users who default their own automation and build scripts to -WindowStyle Hidden out of habit, independent of any deployment tool."49level: low

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where ((FolderPath endswith "\\powershell.exe" or FolderPath endswith "\\pwsh.exe") and (ProcessCommandLine contains "-windowstyle hidden" or ProcessCommandLine contains "/windowstyle hidden" or ProcessCommandLine contains "–windowstyle hidden" or ProcessCommandLine contains "—windowstyle hidden" or ProcessCommandLine contains "―windowstyle hidden" or ProcessCommandLine contains "-windowstyle h" or ProcessCommandLine contains "/windowstyle h" or ProcessCommandLine contains "–windowstyle h" or ProcessCommandLine contains "—windowstyle h" or ProcessCommandLine contains "―windowstyle h" or ProcessCommandLine contains "-win hidden" or ProcessCommandLine contains "/win hidden" or ProcessCommandLine contains "–win hidden" or ProcessCommandLine contains "—win hidden" or ProcessCommandLine contains "―win hidden" or ProcessCommandLine contains "-win h" or ProcessCommandLine contains "/win h" or ProcessCommandLine contains "–win h" or ProcessCommandLine contains "—win h" or ProcessCommandLine contains "―win h"))

Splunk · SPL

Run this as a search.

index=* ((Image="*\\powershell.exe" OR Image="*\\pwsh.exe") AND (CommandLine="*-windowstyle hidden*" OR CommandLine="*/windowstyle hidden*" OR CommandLine="*–windowstyle hidden*" OR CommandLine="*—windowstyle hidden*" OR CommandLine="*―windowstyle hidden*" OR CommandLine="*-windowstyle h*" OR CommandLine="*/windowstyle h*" OR CommandLine="*–windowstyle h*" OR CommandLine="*—windowstyle h*" OR CommandLine="*―windowstyle h*" OR CommandLine="*-win hidden*" OR CommandLine="*/win hidden*" OR CommandLine="*–win hidden*" OR CommandLine="*—win hidden*" OR CommandLine="*―win hidden*" OR CommandLine="*-win h*" OR CommandLine="*/win h*" OR CommandLine="*–win h*" OR CommandLine="*—win h*" OR CommandLine="*―win h*"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((TO_LOWER(process.executable) LIKE "*\\\\powershell.exe" OR TO_LOWER(process.executable) LIKE "*\\\\pwsh.exe") AND (TO_LOWER(process.command_line) LIKE "*-windowstyle hidden*" OR TO_LOWER(process.command_line) LIKE "*/windowstyle hidden*" OR TO_LOWER(process.command_line) LIKE "*–windowstyle hidden*" OR TO_LOWER(process.command_line) LIKE "*—windowstyle hidden*" OR TO_LOWER(process.command_line) LIKE "*―windowstyle hidden*" OR TO_LOWER(process.command_line) LIKE "*-windowstyle h*" OR TO_LOWER(process.command_line) LIKE "*/windowstyle h*" OR TO_LOWER(process.command_line) LIKE "*–windowstyle h*" OR TO_LOWER(process.command_line) LIKE "*—windowstyle h*" OR TO_LOWER(process.command_line) LIKE "*―windowstyle h*" OR TO_LOWER(process.command_line) LIKE "*-win hidden*" OR TO_LOWER(process.command_line) LIKE "*/win hidden*" OR TO_LOWER(process.command_line) LIKE "*–win hidden*" OR TO_LOWER(process.command_line) LIKE "*—win hidden*" OR TO_LOWER(process.command_line) LIKE "*―win hidden*" OR TO_LOWER(process.command_line) LIKE "*-win h*" OR TO_LOWER(process.command_line) LIKE "*/win h*" OR TO_LOWER(process.command_line) LIKE "*–win h*" OR TO_LOWER(process.command_line) LIKE "*—win h*" OR TO_LOWER(process.command_line) LIKE "*―win h*"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="5">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)(\\powershell\.exe$|\\pwsh\.exe$)</field>    <field name="CommandLine" type="pcre2">(?i)(-windowstyle hidden|/windowstyle hidden|–windowstyle hidden|—windowstyle hidden|―windowstyle hidden|-windowstyle h|/windowstyle h|–windowstyle h|—windowstyle h|―windowstyle h|-win hidden|/win hidden|–win hidden|—win hidden|―win hidden|-win h|/win h|–win h|—win h|―win h)</field>    <description>PowerShell launched with a hidden window style</description>    <mitre>      <id>T1564.003</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: low
Category: hide_artifacts
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 445b1c57-564c-427f-a65d-fbff52fad79e

ATT&CKT1564.003

T1564.003Hidden Window

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Evidence

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
0 true · 1 false · 100.0% noise

Noise checkfires on 1 of 30

Fires on 1 of 30 ordinary behaviours the baseline holds for this log type. Each is something a managed estate does on purpose, so each is a false positive an analyst would have to close.

pc-intune-encodedcommand
Intune Management Extension executes remediation scripts as base64. Encoded PowerShell is routine on any Intune-managed estate.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1564.003, evaluated against their process_creation events.

Using it

Tuning & false positivesexperimental · 3 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

MITRE names two knobs on AN0360. HiddenProcessScope — restricting to processes where hidden execution is unexpected, such as PowerShell, cmd or wscript — is effectively already applied by scoping the rule to PowerShell and pwsh specifically rather than any process. ParentProcessCorrelation — narrowing to unexpected parent processes to cut deployment-tool noise — is the highest-value tuning step for a real deployment, since it would distinguish RMM-launched hidden PowerShell from a hidden shell spawned by an Office document or a browser, but it needs a parent-process allowlist built from your own environment's RMM inventory, which nothing in this brief supplies.

Declared by the author

RMM, patch-management and software-deployment tooling — SCCM, Intune, PDQ and most commercial RMM agents — that wraps its payload scripts in powershell.exe -WindowStyle Hidden by convention so an unattended job never flashes a console at a logged-in user; this is an industry-standard pattern and by far the loudest source of matches here.
Logon and scheduled-task scripts pushed by Group Policy that call PowerShell with a hidden window so a maintenance task does not interrupt the desktop, which is exactly the legitimate administrative use the technique description itself names.
Developers and power users who default their own automation and build scripts to -WindowStyle Hidden out of habit, independent of any deployment tool.

Lessonhide artifacts

hide artifactsAI draft — unreviewed

01 · What this rule detects

DET0128 carries three per-platform analytics — AN0360 for Windows, AN0361 for Linux, AN0362 for macOS — and only the Windows one names a literal, single-event observable: MITRE's own example in the technique description, powershell.exe -WindowStyle Hidden. AN0361 describes X11/Wayland calls and DISPLAY-variable manipulation that leave no trace in the auditd EXECVE/SYSCALL sources this brief lists — argv carries no windowing-API signal. AN0362 is a plist-modification-plus-correlation pattern spanning multiple events. Both would need invented fields to reach with a single Sigma selection, so only the Windows leg is built here.

02 · Telemetry you need

Sysmon EventID 1 (process_creation) with CommandLine capture enabled. This is the default when Sysmon is installed, so there is no separate audit policy to check before relying on it.

03 · How the logic works

Two blocks, ANDed together. selection_tool matches Image ending in \powershell.exe or \pwsh.exe. selection_hidden matches CommandLine containing -windowstyle hidden, -windowstyle h, -win hidden, or -win h, using the windash modifier so both hyphen- and slash-prefixed switch forms are caught the same way — covering PowerShell's own accepted -Win abbreviation alongside the full parameter name. MITRE's ParentProcessCorrelation knob — narrowing to unexpected parent processes — is named in the analytic but deliberately not applied: doing so would mean inventing a parent-process allowlist with no basis in the brief. As written the rule is broader than the technique and flags every hidden PowerShell launch, administrative or malicious.

04 · Common false positives

-WindowStyle Hidden is an industry-standard convention, not a red flag by itself. The rule's own top false positive — and by far its loudest source of matches — is RMM, patch-management and software-deployment tooling: SCCM, Intune, PDQ, and most commercial RMM agents wrap payload scripts in a hidden window so an unattended job never flashes a console at a logged-in user. Logon and scheduled-task scripts pushed by Group Policy do the same thing so a maintenance task doesn't interrupt the desktop — the exact legitimate use the technique description itself names. Developers and power users also default their own automation to -WindowStyle Hidden out of habit, independent of any deployment tool. Level is low, correctly matching that top false positive: the review found no contradiction between the level and the loudest source of noise.

05 · Detection maturity

tier_1: Lowest DeBMM tier: authored from MITRE's prose, never executed against a log line. It stays there until it has run against real EventID 1 telemetry long enough to characterize how much of the hit volume is deployment tooling versus anything else, and a parent-process allowlist has been built from that observation.

Related detections6 nearby

Ranked by how alike the detection logic reads, computed offline. Proximity is not evidence — each of these carries its own verification state on its own page.

Share this rule

/u/siemphony/445b1c57-564c-427f-a65d-fbff52fad79e

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

PowerShell launched with a hidden window style

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it