Cross-source coverage

T1564.003 / ATT&CK

Hide Artifacts: Hidden Window

17 rules across 4 sources.

From MITRE ATT&CK 19.2

Adversaries may use hidden windows to conceal malicious activity from the plain sight of users. In some cases, windows that would typically be displayed when an application carries out an operation can be hidden. This may be utilized by system administrators to avoid disrupting user work environments when carrying out administrative tasks.

Adversaries may abuse these functionalities to hide otherwise visible windows from users so as not to alert the user to adversary activity on the system.

On macOS, the configurations for how applications run are listed in property list (plist) files. One of the tags in these files can be apple.awt.UIElement, which allows for Java applications to prevent the application's icon from appearing in the Dock. A common use for this is when applications run in the system tray, but don't also want to show up in the Dock.

Similarly, on Windows there are a variety of features in scripting languages, such as PowerShell, Jscript, and Visual Basic to make windows hidden. One example of this is powershell.exe -WindowStyle Hidden.

The Windows Registry can also be edited to hide application windows from the current user. For example, by setting the WindowPosition subkey in the HKEY_CURRENT_USER\Console\%SystemRoot%_System32_WindowsPowerShell_v1.0_PowerShell.exe Registry key to a maximum value, PowerShell windows will open off screen and be hidden.

In addition, Windows supports the CreateDesktop() API that can create a hidden desktop window with its own corresponding explorer.exe process. All applications running on the hidden desktop window, such as a hidden VNC (hVNC) session, will be invisible to other desktops windows.

Adversaries may also leverage cmd.exe as a parent process, and then utilize a LOLBin, such as DeviceCredentialDeployment.exe, to hide windows.

Tactics
Stealth
Platforms
Linux · macOS · Windows
Telemetry
WinEventLog:Sysmonauditd:EXECVEauditd:SYSCALLmacos:unifiedlog

How MITRE says to detect it DET0128

Detection Strategy for Hidden Windows

Windows Analytic 0360

Suspicious use of scripting parameters or registry edits to hide process windows (e.g., powershell.exe -WindowStyle Hidden, or registry modifications pushing window positions off screen). Defender view: correlation of hidden execution with anomalous process lineage or hVNC-like CreateDesktop API calls.

  • WinEventLog:Sysmon EventCode=1
  • WinEventLog:Sysmon EventCode=13, 14

Linux Analytic 0361

Suspicious invocation of GUI utilities or scripts with suppressed or redirected windowing options. Defender view: detection of X11 or Wayland calls to spawn windows that do not appear on active displays, or use of nohup/screen/tmux to mask interactive shells.

  • auditd:EXECVE Execution of GUI-related binaries with suppressed window/display flags
  • auditd:SYSCALL Use of fork/exec with DISPLAY unset or redirected

macOS Analytic 0362

Modification of plist files to set apple.awt.UIElement or similar flags hiding app icons and windows, and dscl/command-line activity that suppresses visibility. Defender view: correlation of plist modifications with unexpected hidden user applications.

  • macos:unifiedlog Modification of plist with apple.awt.UIElement set to TRUE
  • macos:unifiedlog Execution of Java apps or other processes with hidden window attributes

View on attack.mitre.org ↗

SigmaHQ/sigma

8 rules
Detection Severity Format
File Download with Headless Browser High Sigma
HackTool - Covenant PowerShell Launcher High Sigma
Potential Data Stealing Via Chromium Headless Debugging High Sigma
Cmd Launched with Hidden Start Flags to Suspicious Targets Medium Sigma
Powershell Executed From Headless ConHost Process Medium Sigma
PUA - AdvancedRun Execution Medium Sigma
Suspicious PowerShell WindowStyle Option Medium Sigma
Browser Execution In Headless Mode Low Sigma

elastic/protections-artifacts

5 rules
Detection Severity Format
Browser Process Started in a Hidden Desktop Undefined Elastic TOML
Nohup Execution followed by Outbound Network Connection Undefined Elastic TOML
Process Started in a Hidden Desktop Undefined Elastic TOML
Terminal closed with Pkill or Killall Undefined Elastic TOML
Terminal Window Hidden or Closed via Osascript Undefined Elastic TOML

splunk/security_content

3 rules
Detection Severity Format
Headless Browser Mockbin or Mocky Request Undefined SPL
Headless Browser Usage Undefined SPL
Windows ConHost with Headless Argument Undefined SPL

Azure/Azure-Sentinel

1 rule
Detection Severity Format
BadUSB HID injection PowerShell via Windows Run dialog Undefined KQL

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.