T1564.003 Hidden Window
Sub-technique of T1564 Hide Artifacts
Adversaries may use hidden windows to conceal malicious activity from the plain sight of users. In some cases, windows that would typically be displayed when an application carries out an operation can be hidden. This may be utilized by system administrators to avoid disrupting user work environments when carrying out administrative tasks. Adversaries may abuse these functionalities to hide…
Who uses it · with stories on Jábega
Sigma rules to hunt it
- File Download with Headless Browserhightest · windows
- HackTool - Covenant PowerShell Launcherhightest · windows
- Potential Data Stealing Via Chromium Headless Debugginghightest · windows
- PUA - AdvancedRun Executionmediumtest · windows
- Powershell Executed From Headless ConHost Processmediumtest · windows
- Suspicious PowerShell WindowStyle Optionmediumtest · windows
- Cmd Launched with Hidden Start Flags to Suspicious Targetsmedium # can be increased after an initial baseline and tuningexperimental · windows
Rules from SigmaHQ · Detection Rule License 1.1. Technique from MITRE ATT&CK®.