attack_technique: T1564.003
display_name: 'Hide Artifacts: Hidden Window'
atomic_tests:
- name: Hidden Window
  auto_generated_guid: f151ee37-9e2b-47e6-80e4-550b9f999b7a
  description: |
    Launch PowerShell with the "-WindowStyle Hidden" argument to conceal PowerShell windows by setting the WindowStyle parameter to hidden.
    Upon execution a hidden PowerShell window will launch calc.exe
  supported_platforms:
  - windows
  input_arguments:
    powershell_command:
      description: Command to launch calc.exe from a hidden PowerShell Window
      type: String
      default: powershell.exe -WindowStyle hidden calc.exe
  executor:
    command: |
      Start-Process #{powershell_command}
    name: powershell