Detecting and Mitigating Hidden Windows (T1564.003)

If the user never sees a window, the user never wonders about it. Hidden Window (T1564.003) is a Stealth technique for Linux, macOS and Windows, and a subtechnique of Hide Artifacts.

How attackers use it

MITRE explains that administrators sometimes hide windows to avoid disrupting users while doing admin work. Adversaries abuse the same functions to keep windows from alerting a user.

• macOS. The configuration for how applications run lives in plist files. One tag, apple.awt.UIElement, lets Java applications keep their icon out of the Dock. It is commonly used by applications that live in the system tray.
• Windows scripting. PowerShell, JScript and Visual Basic have features to hide windows. MITRE's example is powershell.exe -WindowStyle Hidden.
• Windows registry. Setting the WindowPosition subkey for the PowerShell console to a maximum value makes windows open off screen.
• Hidden desktops. The CreateDesktop API can create a hidden desktop with its own explorer.exe process. Everything running there, such as a hidden VNC (hVNC) session, is invisible to other desktops.

MITRE also notes adversaries may use cmd.exe as a parent process and then a LOLBin, such as DeviceCredentialDeployment.exe, to hide windows.

How to detect it

MITRE's analytics, by platform:

• Windows. Scripting parameters or registry edits that hide process windows, correlated with unusual process lineage or hVNC-like CreateDesktop API calls.
• Linux. GUI utilities or scripts run with suppressed or redirected windowing options, and nohup, screen or tmux used to mask interactive shells.
• macOS. Plist changes that set apple.awt.UIElement or similar flags, and unexpected hidden user applications.

The most practical Windows rule is a command line search for the WindowStyle switch with a value of Hidden, then check which parent process started it. Plenty of admin scripts use it. Your job is to tell which ones are yours.

How to reduce the risk

MITRE lists two mitigations.

1. Execution prevention. Limit or restrict program execution with antivirus software. On macOS, allowlist programs that are permitted to have the plist tag, and treat all others as suspicious.
2. Limit software installation. Restrict installation of software that can create hidden desktops, such as hVNC, to the user groups that need it.

Admins hide windows too

MITRE is clear that hiding windows is a legitimate admin feature. Plenty of scheduled scripts and deployment tools run with a hidden window so users are not interrupted. That means a rule for the hidden window switch alone will fire often. Make it manageable with an allowlist built from your own automation: the script paths, the parent processes and the accounts that use it. What is left after that is what you investigate.

For the hidden desktop case, the signal is different. A second explorer.exe process, or a remote access tool such as VNC on a machine that should not have one, deserves attention. MITRE's mitigation of limiting who can install software that creates hidden desktops speaks to this: if the tools cannot be installed, the technique has less to work with.

Check your own environment

# Windows (PowerShell): processes started with a hidden window style, read-only
Get-CimInstance Win32_Process | Where-Object { $_.CommandLine -match 'WindowStyle\s+Hidden' } | Select-Object ProcessId,Name,CommandLine

Review each hit against your known automation. Anything you cannot explain is a lead.

Quick check

Sources

• MITRE ATT&CK T1564.003: Hidden Window