Procedure examples

APT3 has been known to use -WindowStyle Hidden to conceal PowerShell windows.

Kimsuky has used an information gathering module that will hide an AV software window from the victim. Kimsuky has also been known to use `-WindowStyle Hidden` to conceal PowerShell windows.

Gorgon Group has used -W Hidden to conceal PowerShell windows by setting the WindowStyle parameter to hidden.

APT32 has used the WindowStyle parameter to conceal PowerShell windows.

Gamaredon Group has used hidcon to run batch files in a hidden console window. Gamaredon Group has also executed PowerShell in a hidden window.

FIN7 has used .txt files to conceal PowerShell commands.

Higaisa used a payload that creates a hidden window.

DarkHydrus has used -WindowStyle Hidden to conceal PowerShell windows.

Medusa Group has utilized the `ShowWindow` API function to hide the current window.

Deep Panda has used -w hidden to conceal PowerShell windows by setting the WindowStyle parameter to hidden.

ToddyCat has hidden malicious scripts using `powershell.exe -windowstyle hidden`.

APT28 has used the WindowStyle parameter to conceal PowerShell windows.

APT-C-36 has set the ShowWindow property of the Win32_ProcessStartup object to zero to hide PowerShell execution.

CopyKittens has used -w hidden and -windowstyle hidden to conceal PowerShell windows.

VOID MANTICORE has utilized PowerShell scripts that run without notifying the user of its execution to include `-nop -w hidden- ep bypass -enc`.

Magic Hound malware has a function to determine whether the C2 server wishes to execute the newly dropped file in a hidden window.

APT19 used -W Hidden to conceal PowerShell windows by setting the WindowStyle parameter to hidden.

Nomadic Octopus executed PowerShell in a hidden window.