ATT&CK technique
View on MITRE ATT&CK →
T1564.003
Hidden Window
Stealth
11 detections found
Detection rules
| Source | Rule | Status | Updated |
|---|---|---|---|
| splunk | Headless Browser Usage | production | 2026-06-25 |
| splunk | Headless Browser Mockbin or Mocky Request | production | 2026-05-13 |
| splunk | Windows ConHost with Headless Argument | production | 2026-05-13 |
| sigma | Cmd Launched with Hidden Start Flags to Suspicious Targets | experimental | 2026-01-24 |
| sigma | File Download with Headless Browser | test | 2025-10-07 |
| sigma | Powershell Executed From Headless ConHost Process | test | 2024-07-23 |
| sigma | Browser Execution In Headless Mode | test | 2023-09-12 |
| sigma | HackTool - Covenant PowerShell Launcher | test | 2023-02-21 |
| sigma | PUA - AdvancedRun Execution | test | 2023-02-21 |
| sigma | Suspicious PowerShell WindowStyle Option | test | 2023-01-03 |
| sigma | Potential Data Stealing Via Chromium Headless Debugging | test | 2022-12-23 |