Technique:  Hide Artifacts:Hidden Window
Agent Tesla has used ProcessWindowStyle.Hidden to hide windows.
It used -W Hidden to conceal PowerShell windows by setting the WindowStyle parameter to hidden.
It has used the WindowStyle parameter to conceal PowerShell windows.
It has been known to use -WindowStyle Hidden to conceal PowerShell windows.
It has used the WindowStyle parameter to conceal PowerShell windows.
Astaroth loads its module with the XSL script parameter vShow set to zero, which opens the application with a hidden window.
AsyncRAT can hide the execution of scheduled tasks using ProcessWindowStyle.Hidden.
AvosLocker has hidden its console window by using the ShowWindow API function.
BONDUPDATER uses -windowstyle hidden to conceal a PowerShell window that downloads a payload.
It has used -w hidden and -windowstyle hidden to conceal PowerShell windows.
Cuba has executed hidden PowerShell windows.
It has used -WindowStyle Hidden to conceal PowerShell windows.
It has used -w hidden to conceal PowerShell windows by setting the WindowStyle parameter to hidden.
It has used hidcon to run batch files in a hidden console window.
It has used -W Hidden to conceal PowerShell windows by setting the WindowStyle parameter to hidden.
HAMMERTOSS has used -WindowStyle hidden to conceal PowerShell windows.
It used a payload that creates a hidden window.
HotCroissant has the ability to hide the window for operations performed on a given file.
InvisiMole has executed legitimate tools in hidden windows.
Kevin can hide the current window from the targeted user via the ShowWindow API function.
KeyBoy uses -w Hidden to conceal a PowerShell window that downloads a payload.
It has used an information gathering module that will hide an AV software window from the victim.
Kivars has the ability to conceal its activity through hiding active windows.
Koadic has used the command Powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden to hide its window.
KOCTOPUS has used -WindowsStyle Hidden to hide the command window.
It malware has a function to determine whether the C2 server wishes to execute the newly dropped file in a hidden window.
MCMD can modify processes to prevent them from being visible on the desktop.
Metamorfo has hidden its GUI using the ShowWindow() WINAPI call.
Meteor can hide its console window upon execution to decrease its visibility to a victim.
It executed PowerShell in a hidden window.
PowerShower has added a registry key so future powershell.exe instances are spawned with coordinates for a window position off-screen by default.
QuasarRAT can hide process windows and make web requests invisible to the compromised user. Requests marked as invisible have been sent with user-agent string Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.75.14 (KHTML, like Gecko) Version/7.0.3 Safari/7046A194A though QuasarRAT can only be run on Windows systems.
QUIETCANARY can execute processes in a hidden window.
QuietSieve has the ability to execute payloads in a hidden window.
SharpDisco can hide windows using ProcessWindowStyle.Hidden.
SILENTTRINITY has the ability to set its window state to hidden.
Snip3 can execute PowerShell scripts in a hidden window.
StrongPity has the ability to hide the console window for its document search module from the user.
Ursnif droppers have used COM properties to execute malware in hidden windows.
WindTail can instruct the OS to execute an application without a dock icon or menu.