kevmap

Techniques › T1564 › T1564.003

T1564.003 Hidden Window

stealth — Linux, macOS, Windows · attack.mitre.org · JSON

1
MITRE detection strategy
3
analytics
8
Sigma rules tagged attack.t1564.003
0
KEV CVEs mapped here
<p>Adversaries may use hidden windows to conceal malicious activity from the plain sight of users. In some cases, windows that would typically be displayed when an application carries out an operation can be hidden. This may be utilized by system administrators to avoid disrupting user work environments when carrying out administrative tasks.</p><p>Adversaries may abuse these functionalities to hide otherwise visible windows from users so as not to alert the user to adversary activity on the system.</p><p>On macOS, the configurations for how applications run are listed in property list (plist) files. One of the tags in these files can be <code>apple.awt.UIElement</code>, which allows for Java applications to prevent the application's icon from appearing in the Dock. A common use for this is when applications run in the system tray, but don't also want to show up in the Dock.</p><p>Similarly, on Windows there are a variety of features in scripting languages, such as PowerShell, Jscript, and Visual Basic to make windows hidden. One example of this is <code>powershell.exe -WindowStyle Hidden</code>.</p><p>The Windows Registry can also be edited to hide application windows from the current user. For example, by setting the WindowPosition subkey in the HKEY_CURRENT_USER\Console\%SystemRoot%_System32_WindowsPowerShell_v1.0_PowerShell.exe Registry key to a maximum value, PowerShell windows will open off screen and be hidden.</p><p>In addition, Windows supports the CreateDesktop() API that can create a hidden desktop window with its own corresponding <code>explorer.exe</code> process. All applications running on the hidden desktop window, such as a hidden VNC (hVNC) session, will be invisible to other desktops windows.</p><p>Adversaries may also leverage cmd.exe as a parent process, and then utilize a LOLBin, such as DeviceCredentialDeployment.exe, to hide windows.</p>

KEV CVEs mapped to this technique · CTID Mappings Explorer

None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.

Detection strategy · ATT&CK Enterprise v19.2

Sigma rules · SigmaHQ da9bb07d64, tag attack.t1564.003

Powershell Executed From Headless ConHost Process mediumtest
Author: Matt Anderson (Huntress) · 2024-07-23 · logsource: product=windows category=process_creation · 056c7317-9a09-4bd4-9067-d051312752ea
Detects the use of powershell commands from headless ConHost window. The "--headless" flag hides the windows from the user upon execution.
Techniques: T1059.001T1059.003T1564.003
File Download with Headless Browser hightest
Author: Sreeman, Florian Roth (Nextron Systems) · 2022-01-04 (modified 2025-10-07) · logsource: product=windows category=process_creation · 0e8cfe08-02c9-4815-a2f8-0d157b7ed33e
Detects execution of chromium based browser in headless mode using the "dump-dom" command line to download files
Techniques: T1105T1564.003
Suspicious PowerShell WindowStyle Option mediumtest
Author: frack113, Tim Shelton (fp AWS) · 2021-10-20 (modified 2023-01-03) · logsource: product=windows category=ps_script · 313fbb0a-a341-4682-848d-6d6f8c4fab7c
Adversaries may use hidden windows to conceal malicious activity from the plain sight of users. In some cases, windows that would typically be displayed when an application carries out an operation can be hidden
Techniques: T1564.003
Potential Data Stealing Via Chromium Headless Debugging hightest
Author: Nasreddine Bencherchali (Nextron Systems) · 2022-12-23 · logsource: product=windows category=process_creation · 3e8207c5-fcd2-4ea6-9418-15d45b4890e4
Detects chromium based browsers starting in headless and debugging mode and pointing to a user profile. This could be a sign of data stealing or remote control
Techniques: T1185T1564.003
Cmd Launched with Hidden Start Flags to Suspicious Targets mediumexperimental
Author: Vladan Sekulic, Swachchhanda Shrawan Poudel (Nextron Systems) · 2026-01-24 · logsource: product=windows category=process_creation · 5a6b7c8d-9e0f-1a2b-3c4d-5e6f7a8b9c0d
Detects cmd.exe executing commands with the "start" utility using "/b" (no window) or "/min" (minimized) flags. To reduce false positives from standard background tasks, detection is restricted to scenarios where the target is a known script extension or located in suspicious temporary/public directories. This technique was observed in Chaos, DarkSide, and Emotet malware campaigns.
Techniques: T1564.003
HackTool - Covenant PowerShell Launcher hightest
Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community · 2020-06-04 (modified 2023-02-21) · logsource: product=windows category=process_creation · c260b6db-48ba-4b4a-a76f-2f67644e99d2
Detects suspicious command lines used in Covenant luanchers
Techniques: T1059.001T1564.003
PUA - AdvancedRun Execution mediumtest
Author: Florian Roth (Nextron Systems) · 2022-01-20 (modified 2023-02-21) · logsource: product=windows category=process_creation · d2b749ee-4225-417e-b20e-a8d2193cbb84
Detects the execution of AdvancedRun utility
Techniques: T1564.003T1134.002T1059.003
Browser Execution In Headless Mode lowtest
Author: Nasreddine Bencherchali (Nextron Systems) · 2023-09-12 · logsource: product=windows category=process_creation · ef9dcfed-690c-4c5d-a9d1-482cd422225c
Detects execution of Chromium based browser in headless mode
Techniques: T1105T1564.003

Rules tagged at the parent level (attack.t1564) 10

These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.

Sysmon Configuration Modification hightest
Author: frack113 · 2021-06-04 (modified 2022-08-02) · logsource: product=windows category=sysmon_status · 1f2b5353-573f-4880-8e33-7d04dcf97744
Detects when an attacker tries to hide from Sysmon by disabling or stopping it
Techniques: T1564
CrashControl CrashDump Disabled mediumtest
Author: Tobias Michalski (Nextron Systems) · 2022-02-24 (modified 2023-08-17) · logsource: product=windows category=registry_set · 2ff692c2-4594-41ec-8fcb-46587de769e0
Detects disabling the CrashDump per registry (as used by HermeticWiper)
Techniques: T1564T1112
PUA - System Informer Execution mediumtest
Author: Florian Roth (Nextron Systems) · 2023-05-08 (modified 2024-11-23) · logsource: product=windows category=process_creation · 5722dff1-4bdd-4949-86ab-fbaf707e767a
Detects the execution of System Informer, a task manager tool to view and manipulate processes, kernel options and other low level operations
Techniques: T1082T1564T1543
Potentially Suspicious Execution From Parent Process In Public Folder hightest
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) · 2022-02-25 (modified 2024-07-12) · logsource: product=windows category=process_creation · 69bd9b97-2be2-41b6-9816-fb08757a4d1a
Detects a potentially suspicious execution of a parent process located in the "\Users\Public" folder executing a child process containing references to shell or scripting binaries and commandlines.
Techniques: T1564T1059
Suspicious Executable File Creation hightest
Author: frack113 · 2022-09-05 (modified 2023-12-11) · logsource: product=windows category=file_event · 74babdd6-a758-4549-9632-26535279e654
Detect creation of suspicious executable file names. Some strings look for suspicious file extensions, others look for filenames that exploit unquoted service paths.
Techniques: T1564
PUA - Process Hacker Execution mediumtest
Author: Florian Roth (Nextron Systems) · 2022-10-10 (modified 2024-11-23) · logsource: product=windows category=process_creation · 811e0002-b13b-4a15-9d00-a613fce66e42
Detects the execution of Process Hacker based on binary metadata information (Image, Hash, Imphash, etc). Process Hacker is a tool to view and manipulate processes, kernel options and other low level options. Threat actors abused older vulnerable versions to manipulate system processes.
Techniques: T1622T1564T1543
Sysmon Configuration Error hightest
Author: frack113 · 2021-06-04 (modified 2026-07-23) · logsource: product=windows category=sysmon_error · 815cd91b-7dbc-4247-841a-d7dd1392b0a8
Detects when an adversary is trying to hide it's action from Sysmon logging based on error messages
Techniques: T1564
Virtualbox Driver Installation or Starting of VMs lowtest
Author: Janantha Marasinghe · 2020-09-26 (modified 2025-07-29) · logsource: product=windows category=process_creation · bab049ca-7471-4828-9024-38279a4c04da
Adversaries can carry out malicious operations using a virtual instance to avoid detection. This rule is built to detect the registration of the Virtualbox driver or start of a Virtualbox VM.
Techniques: T1564.006T1564
Suspicious Creation with Colorcpl hightest
Author: frack113 · 2022-01-21 (modified 2023-01-05) · logsource: product=windows category=file_event · e15b518d-b4ce-4410-a9cd-501f23ce4a18
Once executed, colorcpl.exe will copy the arbitrary file to c:\windows\system32\spool\drivers\color\
Techniques: T1564
Mount Execution With Hidepid Parameter mediumtest
Author: Joseliyo Sanchez, @Joseliyo_Jstnk · 2023-01-12 · logsource: product=linux category=process_creation · ec52985a-d024-41e3-8ff6-14169039a0b3
Detects execution of the "mount" command with "hidepid" parameter to make invisible processes to other users from the system
Techniques: T1564