Procedure examples

Cuba has executed hidden PowerShell windows.

PureCrypter can set `ProcessWindowStyle.Hidden` to hide windows on victim machines.

GlassWorm has leveraged Hidden Virtual Network Computing (HVNC) to remain undetected and conduct execution of collection and communication actions.

Metamorfo has hidden its GUI using the ShowWindow() WINAPI call.

QUIETCANARY can execute processes in a hidden window.

LockBit 2.0 can execute command line arguments in a hidden window.

HotCroissant has the ability to hide the window for operations performed on a given file.

OilBooster can hide its console window upon execution through the `ShowWindow` API.

Kivars has the ability to conceal its activity through hiding active windows.

BONDUPDATER uses -windowstyle hidden to conceal a PowerShell window that downloads a payload.

Meteor can hide its console window upon execution to decrease its visibility to a victim.

KOCTOPUS has used -WindowsStyle Hidden to hide the command window.

Kevin can hide the current window from the targeted user via the `ShowWindow` API function.

Agent Tesla has used ProcessWindowStyle.Hidden to hide windows.

Astaroth loads its module with the XSL script parameter vShow set to zero, which opens the application with a hidden window.

WarzoneRAT has the ability of performing remote desktop access via a hVNC window for decreased visibility.

SILENTTRINITY has the ability to set its window state to hidden.

AsyncRAT can hide the execution of scheduled tasks using `ProcessWindowStyle.Hidden`.

Remcos can set `ProcessWindowStyle.Hidden` to hide windows.

MCMD can modify processes to prevent them from being visible on the desktop.

Koadic has used the command Powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden to hide its window.

QuasarRAT can hide process windows and make web requests invisible to the compromised user. Requests marked as invisible have been sent with user-agent string `Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.75.14 (KHTML, like Gecko) Version/7.0.3 Safari/7046A194A` though QuasarRAT can only be run on Windows systems.

APT32 used NTFS alternate data streams to hide their payloads.

PowerDuke hides many of its backdoor payloads in an alternate data stream (ADS).

If the victim is using PowerShell 3.0 or later, POWERSOURCE writes its decoded payload to an alternate data stream (ADS) named kernel32.dll that is saved in %PROGRAMDATA%\Windows\.

WastedLocker has the ability to save and execute files as an alternate data stream (ADS).

The Regin malware platform uses Extended Attributes to store encrypted executables.

Some variants of the Zeroaccess Trojan have been known to store data in Extended Attributes.

Anchor has used NTFS to hide files.

Gazer stores configuration items in alternate data streams (ADSs) if the Registry is not accessible.

Latrodectus can delete itself while its process is still running through the use of an alternate data stream.

Valak has the ability save and execute files as alternate data streams (ADS).

LoJax has loaded an embedded NTFS DXE driver to be able to access and write to NTFS partitions.

The DEADEYE.EMBED variant of DEADEYE can embed its payload in an alternate data stream of a local file.

Astaroth can abuse alternate data streams (ADS) to store content for malicious payloads.

BitPaymer has copied itself to the :bin alternate data stream of a newly created file.

esentutl can be used to read and write alternate data streams.

Expand can be used to download or copy a file into an alternate data stream.

Strider has used a hidden file system that is stored as a file on disk.

Equation has used an encrypted virtual file system stored in the Windows Registry.

Regin has used a hidden file system to store some of its components.

Uroburos can use concealed storage mechanisms including an NTFS or FAT-16 filesystem encrypted with CAST-128 in CBC mode.

BOOTRASH has used unallocated disk space between partitions for a hidden file system that stores components of the Nemesis bootkit.

ComRAT has used a portable FAT16 partition image placed in %TEMP% as a hidden file system.

Ragnar Locker has used VirtualBox and a stripped Windows XP virtual machine to run itself. The use of a shared folder specified in the configuration enables Ragnar Locker to encrypt files on the host operating system, including files on any mapped drives.

Maze operators have used VirtualBox and a Windows 7 virtual machine to run the ransomware; the virtual machine's configuration file mapped the shared network drives of the target company, presumably so Maze can encrypt files on the shared drives as well as the local machine.

LoudMiner has used QEMU and VirtualBox to run a Tiny Core Linux virtual machine, which runs XMRig and makes connections to the C2 server for updates.

Scattered Spider creates inbound rules on the compromised email accounts of security personnel to automatically delete emails from vendor security products.

FIN4 has created rules in victims' Microsoft Outlook accounts to automatically delete emails containing words such as “hacked," "phish," and “malware" in a likely attempt to prevent organizations from communicating about their activities.

Kali365 has the ability to modify email rules to delete email based notifications prior to the victim seeing them.