T1564.003 Hidden Window
Subtécnica de T1564 Hide Artifacts
Adversaries may use hidden windows to conceal malicious activity from the plain sight of users. In some cases, windows that would typically be displayed when an application carries out an operation can be hidden. This may be utilized by system administrators to avoid disrupting user work environments when carrying out administrative tasks. Adversaries may abuse these functionalities to hide…
Quién la usa · con noticias en Jábega
Reglas Sigma para cazarla
- File Download with Headless Browserhightest · windows
- HackTool - Covenant PowerShell Launcherhightest · windows
- Potential Data Stealing Via Chromium Headless Debugginghightest · windows
- PUA - AdvancedRun Executionmediumtest · windows
- Powershell Executed From Headless ConHost Processmediumtest · windows
- Suspicious PowerShell WindowStyle Optionmediumtest · windows
- Cmd Launched with Hidden Start Flags to Suspicious Targetsmedium # can be increased after an initial baseline and tuningexperimental · windows
Reglas de SigmaHQ · Detection Rule License 1.1. Técnica de MITRE ATT&CK®.