T1564.003sub-technique of T1564 Hide Artifacts

Hidden Window

Linux · macOS · Windowsnothing on this site yetT1564.003 on attack.mitre.org

Adversaries may use hidden windows to conceal malicious activity from the plain sight of users. In some cases, windows that would typically be displayed when an application carries out an operation can be hidden. This may be utilized by system administrators to avoid disrupting user work environments when carrying out administrative tasks.
MITRE ATT&CK 19.2, retrieved 2026-09-12

how MITRE says to see it

Detection Strategy for Hidden Windows

Suspicious use of scripting parameters or registry edits to hide process windows (e.g., powershell.exe -WindowStyle Hidden, or registry modifications pushing window positions off screen). Defender view: correlation of hidden execution with anomalous process lineage or hVNC-like CreateDesktop API calls.
Suspicious invocation of GUI utilities or scripts with suppressed or redirected windowing options. Defender view: detection of X11 or Wayland calls to spawn windows that do not appear on active displays, or use of nohup/screen/tmux to mask interactive shells.
Modification of plist files to set apple.awt.UIElement or similar flags hiding app icons and windows, and dscl/command-line activity that suppresses visibility. Defender view: correlation of plist modifications with unexpected hidden user applications.

what reduces it

M1033 Limit Software Installation. Restrict the installation of software that may be abused to create hidden desktops, such as hVNC, to user groups that require it.
M1038 Execution Prevention. Limit or restrict program execution using anti-virus software. On MacOS, allowlist programs that are allowed to have the plist tag. All other programs should be considered suspicious.

the rest of T1564

T1564.001 Hidden Files and Directories · not covered yet
T1564.002 Hidden Users · not covered yet
T1564.004 NTFS File Attributes · not covered yet
T1564.005 Hidden File System · not covered yet
T1564.006 Run Virtual Instance · not covered yet
T1564.007 VBA Stomping · not covered yet
T1564.008 Email Hiding Rules · 2 on this site
T1564.009 Resource Forking · not covered yet
T1564.010 Process Argument Spoofing · not covered yet
T1564.011 Ignore Process Interrupts · not covered yet
T1564.012 File/Path Exclusions · not covered yet
T1564.013 Bind Mounts · not covered yet
T1564.014 Extended Attributes · not covered yet

The description, detection analytics and mitigations are reproduced from MITRE ATT&CK, version 19.2, under its terms of use. The checklists, hunts, labs and everything else linked here are this site’s.