T1564.003 Hide Artifacts: Hidden Window

Adversaries may use hidden windows to conceal malicious activity from the plain sight of users. MITRE ATT&CK

2 programs on CmdID 7 Sigma rules T1564.003 on attack.mitre.org

Part of

MITRE ATT&CK

T1564Hide Artifacts

documented by LOLBAS and GTFOBins, or named by its rules

process creation, the highest levels first

highFile Download with Headless BrowserSreeman, Florian Roth (Nextron Systems) · Windows

highHackTool - Covenant PowerShell LauncherFlorian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community · Windows

highPotential Data Stealing Via Chromium Headless DebuggingNasreddine Bencherchali (Nextron Systems) · Windows

mediumCmd Launched with Hidden Start Flags to Suspicious TargetsVladan Sekulic, Swachchhanda Shrawan Poudel (Nextron Systems) · Windows

mediumPUA - AdvancedRun ExecutionFlorian Roth (Nextron Systems) · Windows

lowBrowser Execution In Headless ModeNasreddine Bencherchali (Nextron Systems) · Windows