PowerShell Creating Hidden File

Swachchhanda Shrawan Poudel (Nextron Systems)

Detects PowerShell commands that create hidden files in the Windows file system, which may indicate malicious activity or an attempt to hide persistence mechanisms. Threat actors may use PowerShell to create hidden files often containing malicious scripts or payloads, leveraging the 'Hidden' attribute.

2025-08-13 00:00:00

None

d4d77118-43c4-4e52-865d-81f9d7e79fc3

attack.defense-evasion attack.persistence attack.t1564.001

Nextron Sigma feed only (private)