Hidden PowerShell execution

Flags such as `-WindowStyle Hidden` or similar launch patterns are commonly used to reduce user visibility during malicious or deceptive script execution.

What it changes in triage

• User awarenessThe operator or victim may not have seen a visible console window.
• Intent signalHidden execution increases suspicion because it prioritizes stealth over transparency.

Next actions

• Correlate process treeCheck parent process and command line telemetry to understand the launch chain.
• Review persistenceHidden execution often appears alongside temp staging or scheduled task creation.