{"id":"T1564.003","name":"Hidden Window","url":"https://attack.mitre.org/techniques/T1564/003","tactics":["stealth"],"platforms":["Linux","macOS","Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0128","stix_id":"x-mitre-detection-strategy--1167a6c8-d735-4d5d-81f5-d81c6eafe239","name":"Detection Strategy for Hidden Windows","url":"https://attack.mitre.org/detectionstrategies/DET0128","analytics":[{"id":"AN0360","stix_id":"x-mitre-analytic--b3bad14e-39a8-4e90-b3e3-46974fd9c2bd","name":"Analytic 0360","description":"Suspicious use of scripting parameters or registry edits to hide process windows (e.g., powershell.exe -WindowStyle Hidden, or registry modifications pushing window positions off screen). Defender view: correlation of hidden execution with anomalous process lineage or hVNC-like CreateDesktop API calls.","url":"https://attack.mitre.org/detectionstrategies/DET0128#AN0360","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Sysmon","channel":"EventCode=1","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=13, 14","data_component":"DC0063","data_component_name":"Windows Registry Key Modification","log_source_slug":"wineventlog-sysmon"}],"mutable_elements":[{"field":"HiddenProcessScope","description":"Restrict to processes where hidden execution is unexpected (e.g., PowerShell, cmd, wscript)."},{"field":"ParentProcessCorrelation","description":"Correlate hidden execution with suspicious parent processes to reduce false positives."}],"live":true,"detection_strategies":["DET0128"],"techniques":["T1564.003"]},{"id":"AN0361","stix_id":"x-mitre-analytic--7ef0d746-f233-4b41-b999-43a6b1484574","name":"Analytic 0361","description":"Suspicious invocation of GUI utilities or scripts with suppressed or redirected windowing options. Defender view: detection of X11 or Wayland calls to spawn windows that do not appear on active displays, or use of nohup/screen/tmux to mask interactive shells.","url":"https://attack.mitre.org/detectionstrategies/DET0128#AN0361","platforms":["Linux"],"log_source_references":[{"name":"auditd:EXECVE","channel":"Execution of GUI-related binaries with suppressed window/display flags","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"auditd-execve"},{"name":"auditd:SYSCALL","channel":"Use of fork/exec with DISPLAY unset or redirected","data_component":"DC0034","data_component_name":"Process Metadata","log_source_slug":"auditd-syscall"}],"mutable_elements":[{"field":"DisplayScope","description":"Restrict monitoring to interactive GUI contexts rather than server/headless processes."}],"live":true,"detection_strategies":["DET0128"],"techniques":["T1564.003"]},{"id":"AN0362","stix_id":"x-mitre-analytic--3d9fb03c-fcc9-4f19-9c49-09d8321f28b9","name":"Analytic 0362","description":"Modification of plist files to set apple.awt.UIElement or similar flags hiding app icons and windows, and dscl/command-line activity that suppresses visibility. Defender view: correlation of plist modifications with unexpected hidden user applications.","url":"https://attack.mitre.org/detectionstrategies/DET0128#AN0362","platforms":["macOS"],"log_source_references":[{"name":"macos:unifiedlog","channel":"Modification of plist with apple.awt.UIElement set to TRUE","data_component":"DC0061","data_component_name":"File Modification","log_source_slug":"macos-unifiedlog"},{"name":"macos:unifiedlog","channel":"Execution of Java apps or other processes with hidden window attributes","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"macos-unifiedlog"}],"mutable_elements":[{"field":"PlistScope","description":"Restrict detection to application plists where UIElement flag is unexpected."},{"field":"UserContext","description":"Correlate plist modifications with the creating/modifying user to tune results."}],"live":true,"detection_strategies":["DET0128"],"techniques":["T1564.003"]}],"live":true,"version":"1.0","techniques":["T1564.003"]}],"sigma_rules":[{"id":"056c7317-9a09-4bd4-9067-d051312752ea","title":"Powershell Executed From Headless ConHost Process","author":"Matt Anderson (Huntress)","status":"test","level":"medium","date":"2024-07-23","modified":null,"description":"Detects the use of powershell commands from headless ConHost window.\nThe \"--headless\" flag hides the windows from the user upon execution.\n","references":["https://www.huntress.com/blog/fake-browser-updates-lead-to-boinc-volunteer-computing-software"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.t1059.001","attack.t1059.003","attack.t1564.003"],"path":"rules/windows/process_creation/proc_creation_win_conhost_headless_powershell.yml","techniques":["T1059.001","T1059.003","T1564.003"],"cves":[]},{"id":"0e8cfe08-02c9-4815-a2f8-0d157b7ed33e","title":"File Download with Headless Browser","author":"Sreeman, Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2022-01-04","modified":"2025-10-07","description":"Detects execution of chromium based browser in headless mode using the \"dump-dom\" command line to download files","references":["https://twitter.com/mrd0x/status/1478234484881436672?s=12","https://www.trendmicro.com/en_us/research/23/e/managed-xdr-investigation-of-ducktail-in-trend-micro-vision-one.html"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.command-and-control","attack.stealth","attack.t1105","attack.t1564.003"],"path":"rules/windows/process_creation/proc_creation_win_browsers_chromium_headless_file_download.yml","techniques":["T1105","T1564.003"],"cves":[]},{"id":"313fbb0a-a341-4682-848d-6d6f8c4fab7c","title":"Suspicious PowerShell WindowStyle Option","author":"frack113, Tim Shelton (fp AWS)","status":"test","level":"medium","date":"2021-10-20","modified":"2023-01-03","description":"Adversaries may use hidden windows to conceal malicious activity from the plain sight of users.\nIn some cases, windows that would typically be displayed when an application carries out an operation can be hidden\n","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1564.003/T1564.003.md"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.stealth","attack.t1564.003"],"path":"rules/windows/powershell/powershell_script/posh_ps_susp_windowstyle.yml","techniques":["T1564.003"],"cves":[]},{"id":"3e8207c5-fcd2-4ea6-9418-15d45b4890e4","title":"Potential Data Stealing Via Chromium Headless Debugging","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2022-12-23","modified":null,"description":"Detects chromium based browsers starting in headless and debugging mode and pointing to a user profile. This could be a sign of data stealing or remote control","references":["https://github.com/defaultnamehere/cookie_crimes/","https://mango.pdf.zone/stealing-chrome-cookies-without-a-password","https://embracethered.com/blog/posts/2020/cookie-crimes-on-mirosoft-edge/","https://embracethered.com/blog/posts/2020/chrome-spy-remote-control/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.credential-access","attack.collection","attack.stealth","attack.t1185","attack.t1564.003"],"path":"rules/windows/process_creation/proc_creation_win_browsers_chromium_headless_debugging.yml","techniques":["T1185","T1564.003"],"cves":[]},{"id":"5a6b7c8d-9e0f-1a2b-3c4d-5e6f7a8b9c0d","title":"Cmd Launched with Hidden Start Flags to Suspicious Targets","author":"Vladan Sekulic, Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"medium","date":"2026-01-24","modified":null,"description":"Detects cmd.exe executing commands with the \"start\" utility using \"/b\" (no window) or \"/min\" (minimized) flags.\nTo reduce false positives from standard background tasks, detection is restricted to scenarios where the target is a known script extension or located in suspicious temporary/public directories.\nThis technique was observed in Chaos, DarkSide, and Emotet malware campaigns.\n","references":["https://www.fortinet.com/blog/threat-research/evolution-of-chaos-ransomware-faster-smarter-and-more-dangerous","https://www.fortinet.com/blog/threat-research/newly-discovered-function-in-darkside-ransomware-variant-targets-disk-partitions","https://www.fortinet.com/blog/threat-research/ms-office-files-involved-in-emotet-trojan-campaign-pt-one","https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/start"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1564.003"],"path":"rules/windows/process_creation/proc_creation_win_cmd_launched_with_hidden_start_flag.yml","techniques":["T1564.003"],"cves":[]},{"id":"c260b6db-48ba-4b4a-a76f-2f67644e99d2","title":"HackTool - Covenant PowerShell Launcher","author":"Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community","status":"test","level":"high","date":"2020-06-04","modified":"2023-02-21","description":"Detects suspicious command lines used in Covenant luanchers","references":["https://posts.specterops.io/covenant-v0-5-eee0507b85ba"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.t1059.001","attack.t1564.003"],"path":"rules/windows/process_creation/proc_creation_win_hktl_covenant.yml","techniques":["T1059.001","T1564.003"],"cves":[]},{"id":"d2b749ee-4225-417e-b20e-a8d2193cbb84","title":"PUA - AdvancedRun Execution","author":"Florian Roth (Nextron Systems)","status":"test","level":"medium","date":"2022-01-20","modified":"2023-02-21","description":"Detects the execution of AdvancedRun utility","references":["https://twitter.com/splinter_code/status/1483815103279603714","https://medium.com/s2wblog/analysis-of-destructive-malware-whispergate-targeting-ukraine-9d5d158f19f3","https://www.elastic.co/security-labs/operation-bleeding-bear","https://www.winhelponline.com/blog/run-program-as-system-localsystem-account-windows/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.privilege-escalation","attack.stealth","attack.t1564.003","attack.t1134.002","attack.t1059.003"],"path":"rules/windows/process_creation/proc_creation_win_pua_advancedrun.yml","techniques":["T1564.003","T1134.002","T1059.003"],"cves":[]},{"id":"ef9dcfed-690c-4c5d-a9d1-482cd422225c","title":"Browser Execution In Headless Mode","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"low","date":"2023-09-12","modified":null,"description":"Detects execution of Chromium based browser in headless mode","references":["https://twitter.com/mrd0x/status/1478234484881436672?s=12","https://www.trendmicro.com/en_us/research/23/e/managed-xdr-investigation-of-ducktail-in-trend-micro-vision-one.html"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.command-and-control","attack.stealth","attack.t1105","attack.t1564.003"],"path":"rules/windows/process_creation/proc_creation_win_browsers_chromium_headless_exec.yml","techniques":["T1105","T1564.003"],"cves":[]}],"kev_cves":[],"_built":"2026-08-23 05:47 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}