tfMITRE ATT&CK sub-technique

Hidden Window T1564.003

Tactic: Stealth
Platforms: Linux, macOS, Windows
Version: 2.0
Created: 13 March 2020
Last modified: 12 May 2026
Contributors: Liran Ravich, CardinalOps; Mark Tsipershtein; Travis Smith, Tripwire; Vijay Lalwani

Adversaries may use hidden windows to conceal malicious activity from the plain sight of users. In some cases, windows that would typically be displayed when an application carries out an operation can be hidden. This may be utilized by system administrators to avoid disrupting user work environments when carrying out administrative tasks.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsTop 10%

Threat groups90th percentile · 90% of ATT&CK techniques have this many threat groups attributed or fewer.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malwareTop 9%

Tools & malware91st percentile · 91% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rulesTop 23%

Detection rules77th percentile · 77% of ATT&CK techniques have this many detection rules written or fewer.

Hidden Window MITRE reference T1564.003

Top 10%of all ATT&CK techniques for number of groups

18 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

VOID MANTICOREG1055 ↗

Has utilized PowerShell scripts that run without notifying the user of its execution to include -nop -w hidden- ep bypass -enc.1

created 2026-04-201 referenceaka COBALT MYSTIQUE

Medusa GroupG1051 ↗

Has utilized the ShowWindow API function to hide the current window.1

created 2025-10-151 reference

ToddyCatG1022 ↗

Has hidden malicious scripts using powershell.exe -windowstyle hidden. 1

created 2024-01-031 reference

Nomadic OctopusG0133 ↗

Executed PowerShell in a hidden window.1

created 2021-08-241 referenceaka DustSquad

HigaisaG0126 ↗

Used a payload that creates a hidden window.1

created 2021-03-051 reference

APT-C-36G0099 ↗

Has set the ShowWindow property of the Win32_ProcessStartup object to zero to hide PowerShell execution.1

created 2020-05-051 referenceaka Blind Eagle

All 18 groups for this technique · 6 newest in this preview

43 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.

Tsundere BotnetS9034 ↗

Tsundere Botnet’s MSI installer has used -WindowStyle Hidden to hide Tsundere Botnet’s execution from the user.1

created 2026-04-20MALWAREcarried by 1 group

PureCrypterS9019 ↗

Can set ProcessWindowStyle.Hidden to hide windows on victim machines.1

created 2026-04-16MALWAREcarried by 1 group

GlassWormS9010 ↗

Has leveraged Hidden Virtual Network Computing (HVNC) to remain undetected and conduct execution of collection and communication actions.1

created 2026-04-10MALWARE

SystemBCS9001 ↗

Has utilized the -WindowStyle Hidden -ep bypass -file to conceal PowerShell windows.1

created 2025-12-15MALWAREcarried by 3 groups

InvisibleFerretS1245 ↗

Has executed Python instances of the browser module “.n2/bow” utilizing the CREATE_NO_WINDOW process creation flag.1

created 2025-10-17MALWAREcarried by 1 group

Medusa RansomwareS1244 ↗

Has utilized the ShowWindow function to hide current window.1

created 2025-10-17MALWAREcarried by 1 group

All 43 software entries for this technique · 6 newest in this preview

Offense vs defense T1564.003

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 0Sigma rules (cumulative) · 8Splunk ESCU (cumulative) · 3

first rule: 2020 Q2

Hidden Window detection strategy DET0128

MITRE names one behaviour worth catching for this technique and breaks it into 3 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection Strategy for Hidden Windows

Enterprise

3 platforms

AN0360 · Windows

Suspicious use of scripting parameters or registry edits to hide process windows (e.g., powershell.exe -WindowStyle Hidden, or registry modifications pushing window positions off screen). Defender view: correlation of hidden execution with anomalous process lineage or hVNC-like CreateDesktop API calls.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1
Windows Registry Key ModificationDC0063	WinEventLog:Sysmon	EventCode=13, 14

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
HiddenProcessScope	Restrict to processes where hidden execution is unexpected (e.g., PowerShell, cmd, wscript).
ParentProcessCorrelation	Correlate hidden execution with suspicious parent processes to reduce false positives.

AN0361 · Linux

Suspicious invocation of GUI utilities or scripts with suppressed or redirected windowing options. Defender view: detection of X11 or Wayland calls to spawn windows that do not appear on active displays, or use of nohup/screen/tmux to mask interactive shells.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process MetadataDC0034	auditd:SYSCALL	Use of fork/exec with DISPLAY unset or redirected
Command ExecutionDC0064	auditd:EXECVE	Execution of GUI-related binaries with suppressed window/display flags

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
DisplayScope	Restrict monitoring to interactive GUI contexts rather than server/headless processes.

AN0362 · macOS

Modification of plist files to set apple.awt.UIElement or similar flags hiding app icons and windows, and dscl/command-line activity that suppresses visibility. Defender view: correlation of plist modifications with unexpected hidden user applications.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	macos:unifiedlog	Execution of Java apps or other processes with hidden window attributes
File ModificationDC0061	macos:unifiedlog	Modification of plist with apple.awt.UIElement set to TRUE

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
PlistScope	Restrict detection to application plists where UIElement flag is unexpected.
UserContext	Correlate plist modifications with the creating/modifying user to tune results.

Tests3ExecutorsPowerShell 2 · cmd 1Need elevation1 of 3Have prerequisites0Have cleanup2Platformswindows

Test

Platform

Executor

Elevation

Prereqs

Cleanup

Ref

Hidden Window

windows

PowerShell

—

Launch PowerShell with the "-WindowStyle Hidden" argument to conceal PowerShell windows by setting the WindowStyle parameter to hidden. Upon execution a hidden PowerShell window will launch calc.exe

Input arguments

Name	Type	Default	Description
powershell_command	string	powershell.exe -WindowStyle hidden calc.exe	Command to launch calc.exe from a hidden PowerShell Window

Attack command

Start-Process #{powershell_command}

GUID2d66edd0-fdbf-4ef3-93af-565a93f41d34

Headless Browser Accessing Mockbin

windows

cmd

—

Yes

The following Atomic Red Team test leverages the Chrome headless browser to access a mockbin site. Create your own Mockbin.org site and replace the BIN in the inputs. The default Mockbin ID forwards to google.com and you may view the details here https://mockbin.org/bin/f6b9a876-a826-4ac0-83b8-639d6ad516ec/view. Reference: https://cert.gov.ua/article/5702579

Input arguments

Name	Type	Default	Description
bin_id	string	f6b9a876-a826-4ac0-83b8-639d6ad516ec	Mockbin.org BIN ID
browser	string	chrome	Browser to use (msedge, chrome, firefox)

Attack command

start "" #{browser} --headless --disable-gpu https://mockbin.org/bin/#{bin_id}

Cleanup command

taskkill /im #{browser} /f

GUID75ddf8a0-23c5-429d-be47-622a601fa5bd

Hidden Window-Conhost Execution

windows

PowerShell

Required

—

Yes

Tests from Atomic Red Team (MIT licence) · technique definition

Hidden Window detections T1564.003

11 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

Top 23%of all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs