attack.t1564.003

Browser Execution In Headless Mode

Apr 28, 2026 · attack.command-and-control attack.stealth attack.t1105 attack.t1564.003 ·

Detects execution of Chromium based browser in headless mode

Cmd Launched with Hidden Start Flags to Suspicious Targets

Apr 28, 2026 · attack.stealth attack.t1564.003 ·

Detects cmd.exe executing commands with the "start" utility using "/b" (no window) or "/min" (minimized) flags. To reduce false positives from standard background tasks, detection is restricted to scenarios where the target is a known script extension or located in suspicious temporary/public directories. This technique was observed in Chaos, DarkSide, and Emotet malware campaigns.

File Download with Headless Browser

Apr 28, 2026 · attack.command-and-control attack.stealth attack.t1105 attack.t1564.003 ·

Share on:

Detects execution of chromium based browser in headless mode using the "dump-dom" command line to download files

HackTool - Covenant PowerShell Launcher

Apr 28, 2026 · attack.execution attack.stealth attack.t1059.001 attack.t1564.003 ·

Share on:

Detects suspicious command lines used in Covenant luanchers

Potential Data Stealing Via Chromium Headless Debugging

Apr 28, 2026 · attack.credential-access attack.collection attack.stealth attack.t1185 attack.t1564.003 ·

Share on:

Detects chromium based browsers starting in headless and debugging mode and pointing to a user profile. This could be a sign of data stealing or remote control

Powershell Executed From Headless ConHost Process

Apr 28, 2026 · attack.execution attack.stealth attack.t1059.001 attack.t1059.003 attack.t1564.003 ·

Share on:

Detects the use of powershell commands from headless ConHost window. The "--headless" flag hides the windows from the user upon execution.

PUA - AdvancedRun Execution

Apr 28, 2026 · attack.execution attack.privilege-escalation attack.stealth attack.t1564.003 attack.t1134.002 attack.t1059.003 ·

Share on:

Detects the execution of AdvancedRun utility

Suspicious PowerShell WindowStyle Option

Apr 28, 2026 · attack.stealth attack.t1564.003 ·

Share on:

Adversaries may use hidden windows to conceal malicious activity from the plain sight of users. In some cases, windows that would typically be displayed when an application carries out an operation can be hidden