{"id":"313fbb0a-a341-4682-848d-6d6f8c4fab7c","title":"Suspicious PowerShell WindowStyle Option","description":"Adversaries may use hidden windows to conceal malicious activity from the plain sight of users.\nIn some cases, windows that would typically be displayed when an application carries out an operation can be hidden\n","author":"frack113, Tim Shelton (fp AWS)","status":"test","level":"medium","date":"2021-10-20","modified":"2023-01-03","tags":["attack.stealth","attack.t1564.003"],"technique_ids":["T1564.003"],"logsource":{"product":"windows","category":"ps_script","definition":"Requirements: Script Block Logging must be enabled"},"falsepositives":["Unknown"],"references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1564.003/T1564.003.md"],"source_path":"rules/windows/powershell/powershell_script/posh_ps_susp_windowstyle.yml","source_sha256":"6a9aad61631f9af45a52e1c47d0cad65254ad0d4c5241c5eced3b0ceb751cbdd","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/powershell/powershell_script/posh_ps_susp_windowstyle.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Suspicious PowerShell WindowStyle Option\nid: 313fbb0a-a341-4682-848d-6d6f8c4fab7c\nstatus: test\ndescription: |\n    Adversaries may use hidden windows to conceal malicious activity from the plain sight of users.\n    In some cases, windows that would typically be displayed when an application carries out an operation can be hidden\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1564.003/T1564.003.md\nauthor: frack113, Tim Shelton (fp AWS)\ndate: 2021-10-20\nmodified: 2023-01-03\ntags:\n    - attack.stealth\n    - attack.t1564.003\nlogsource:\n    product: windows\n    category: ps_script\n    definition: 'Requirements: Script Block Logging must be enabled'\ndetection:\n    selection:\n        ScriptBlockText|contains|all:\n            - 'powershell'\n            - 'WindowStyle'\n            - 'Hidden'\n    filter:\n        ScriptBlockText|contains|all:\n            - ':\\Program Files\\Amazon\\WorkSpacesConfig\\Scripts\\'\n            - '$PSScriptRoot\\Module\\WorkspaceScriptModule\\WorkspaceScriptModule'\n    condition: selection and not filter\nfalsepositives:\n    - Unknown\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1564.003","id":"T1564.003","name":"Hidden Window","page":"techniques/enterprise/T1564.003/"}],"data_path":"data/detection-rules/313fbb0a-a341-4682-848d-6d6f8c4fab7c.json","kind":"sigma"}