T1564.003Stealth
Hidden Window
Adversaries may use hidden windows to conceal malicious activity from the plain sight of users. In some cases, windows that would typically be displayed when an application carries out an operation can be hidden. This may be utilized by system administrators to avoid disrupting user work environments when carrying out administrative tasks. Adversaries may abuse these functionalities to hide…
CVEs0
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.0
Reports0
Detections
8 Sigma rules tagged T1564.003Hidden WindowT1564.0038 general rules
- File Download with Headless Browserhightest
- HackTool - Covenant PowerShell Launcherhightest
- Potential Data Stealing Via Chromium Headless Debugginghightest
- Powershell Executed From Headless ConHost Processmediumtest
- PUA - AdvancedRun Executionmediumtest
- Suspicious PowerShell WindowStyle Optionmediumtest
- Cmd Launched with Hidden Start Flags to Suspicious Targetsmediumexperimental
- Browser Execution In Headless Modelowtest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to Hidden Window
0 CVEs, by priority. Each link shows its badge.No CVEs are linked to this technique yet.