MITRE ATT&CKsub-technique

T1564.003 Hidden Window

Published 2020-03-13 Modified 2026-05-12 Official page ↗
Domain
enterprise
Tactics
Stealth
Platforms
Linux, macOS, Windows
Version
2.0
Created
2020-03-13

Description

Adversaries may use hidden windows to conceal malicious activity from the plain sight of users. In some cases, windows that would typically be displayed when an application carries out an operation can be hidden. This may be utilized by system administrators to avoid disrupting user work environments when carrying out administrative tasks. Adversaries may abuse these functionalities to hide otherwise visible windows from users so as not to alert the user to adversary activity on the system. On macOS, the configurations for how applications run are listed in property list (plist) files. One of the tags in these files can be apple.awt.UIElement, which allows for Java applications to prevent the application's icon from appearing in the Dock. A common use for this is when applications run in the system tray, but don't also want to show up in the Dock. Similarly, on Windows there are a variety of features in scripting languages, such as PowerShell, Jscript, and Visual Basic to make windows hidden. One example of this is powershell.exe -WindowStyle Hidden. The Windows Registry can also be edited to hide application windows from the current user. For example, by setting the `WindowPosition` subkey in the `HKEY_CURRENT_USER\Console\%SystemRoot%_System32_WindowsPowerShell_v1.0_PowerShell.exe` Registry key to a maximum value, PowerShell windows will open off screen and be hidden. In addition, Windows supports the `CreateDesktop()` API that can create a hidden desktop window with its own corresponding explorer.exe process. All applications running on the hidden desktop window, such as a hidden VNC (hVNC) session, will be invisible to other desktops windows. Adversaries may also leverage cmd.exe as a parent process, and then utilize a LOLBin, such as DeviceCredentialDeployment.exe, to hide windows.

Related

Subtechnique of · MITRE ATT&CK (1)

  • T1564 Hide Artifacts technique

Tactic · MITRE ATT&CK (1)

Referenced by MITRE ATT&CK · mitigates (2)

  • M1033 Limit Software Installation mitigation
  • M1038 Execution Prevention mitigation

Referenced by MITRE ATT&CK · uses (62)

  • G1055 VOID MANTICORE group
  • S9034 Tsundere Botnet software (malware)
  • S9019 PureCrypter software (malware)
  • S9010 GlassWorm software (malware)
  • S9001 SystemBC software (malware)
  • S1244 Medusa Ransomware software (malware)
  • S1245 InvisibleFerret software (malware)
  • G1051 Medusa Group group
  • S1237 CANONSTAGER software (malware)
  • S1226 BOOKWORM software (malware)
  • S1213 Lumma Stealer software (malware)
  • S1199 LockBit 2.0 software (malware)
  • S1172 OilBooster software (malware)
  • S1152 IMAPLoader software (malware)
  • G1022 ToddyCat group
  • S1089 SharpDisco software (malware)
  • S1087 AsyncRAT software (tool)
  • S1086 Snip3 software (malware)
  • S1076 QUIETCANARY software (malware)
  • S1053 AvosLocker software (malware)
  • S1020 Kevin software (malware)
  • S0692 SILENTTRINITY software (tool)
  • S0688 Meteor software (malware)
  • S0686 QuietSieve software (malware)
  • S0670 WarzoneRAT software (malware)
  • S0669 KOCTOPUS software (malware)
  • G0133 Nomadic Octopus group
  • S0625 Cuba software (malware)
  • G0126 Higaisa group
  • S0500 MCMD software (tool)
Show all 62 ›

Referenced by Compliance · mitigates (4)

  • CIS-2.5 Allowlist Authorized Software CIS Safeguard v8.1
  • NIST-CM-7 Least Functionality NIST 800-53 control
  • NIST-SI-10 Information Input Validation NIST 800-53 control
  • NIST-SI-7 Software, Firmware, and Information Integrity NIST 800-53 control

References