T1564.003 — Hidden Window

Tactic: Stealth · Platforms: Linux, macOS, Windows

Adversaries may use hidden windows to conceal malicious activity from the plain sight of users. In some cases, windows that would typically be displayed when an application carries out an operation can be hidden. This may be utilized by system administrators to avoid disrupting user work…

Sub-technique of Hide Artifacts (T1564).

Sigma detection rules (3)

T1564.003 Hide Artifacts: Hidden Window

title: "T1564.003 Hide Artifacts: Hidden Window"
id: 5fa779c8-e100-4a40-b010-0710df42779a
description: 'Detects process creation with command-line switches requesting a hidden or minimized window (e.g. PowerShell -WindowStyle Hidden), used to conceal malicious activity from the logged-on user. (Data Component: Process Creation; baseline tier: windows-eventid.) Tune using: HiddenProcessScope, ParentProcessCorrelation.'
references:
  - https://attack.mitre.org/techniques/T1564/003
author: Shahrukh Khan
date: 2026-06-05
license: MIT
tags:
  - attack.stealth
  - attack.t1564.003

logsource:
  category: process_creation
  product: windows
  service: sysmon

detection:
  selection:
    EventID: 1

  selection_hidden:
    CommandLine|contains:
      - '-windowstyle hidden'
      - '-windowstyle 1'
      - '-w hidden'
      - '-win 1'

  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  condition: selection and selection_hidden and not filter_system_account

falsepositives:
  - Scheduled tasks and automation scripts intentionally launched with hidden windows for non-malicious background jobs.
  - System and service accounts (SYSTEM, LOCAL SERVICE, NETWORK SERVICE) performing the same action are excluded via filter_system_account; tune further with process/path allowlists if noise remains.

level: medium

T1564.003 Hide Artifacts: Hidden Window

title: "T1564.003 Hide Artifacts: Hidden Window"
id: 7f93fd04-a274-4b1b-8c01-aa8309caa5da
description: 'Detection Strategy for Hidden Windows. (Retargeted to the process_creation auditd telemetry that actually captures this techniques behavior; see logsource below.) Tune using: DisplayScope.'
references:
  - https://attack.mitre.org/techniques/T1564/003
author: Shahrukh Khan
date: 2026-06-19
license: MIT
tags:
  - attack.stealth
  - attack.t1564.003

logsource:
  category: process_creation
  product: linux

detection:
  selection:
    type: EXECVE
    a0|endswith:
      - '/xdotool'
      - '/wmctrl'
    a1|contains:
      - 'windowunmap'
      - '-b add,hidden'

  condition: selection

falsepositives:
  - Hidden-window techniques are largely an X11/Wayland window-manager concept auditd cannot see directly; this only catches command-line window-hiding utilities and misses hiding performed programmatically via Xlib calls from within a process.

level: low

T1564.003 Hide Artifacts: Hidden Window

title: "T1564.003 Hide Artifacts: Hidden Window"
id: ddef9fa5-3697-437f-b82c-39556d44db6a
description: 'Detection Strategy for Hidden Windows. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: PlistScope, UserContext.'
references:
  - https://attack.mitre.org/techniques/T1564/003
author: Shahrukh Khan
date: 2026-03-04
license: MIT
tags:
  - attack.stealth
  - attack.t1564.003

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|endswith: '/osascript'
    CommandLine|contains|all:
      - 'set visible'
      - 'false'

  condition: selection

falsepositives:
  - Legitimate background automation scripts that intentionally hide an applications window while performing scheduled tasks.

level: low

Related sub-techniques

Explore