AN0360
Analytic 0360
Windows
Suspicious use of scripting parameters or registry edits to hide process windows (e.g., powershell.exe -WindowStyle Hidden, or registry modifications pushing window positions off screen). Defender view: correlation of hidden execution with anomalous process lineage or hVNC-like CreateDesktop API calls.
WinEventLog:Sysmon
EventCode=1
WinEventLog:Sysmon
EventCode=13, 14
[HiddenProcessScope]
Restrict to processes where hidden execution is unexpected (e.g., PowerShell, cmd, wscript).
[ParentProcessCorrelation]
Correlate hidden execution with suspicious parent processes to reduce false positives.
AN0361
Analytic 0361
Linux
Suspicious invocation of GUI utilities or scripts with suppressed or redirected windowing options. Defender view: detection of X11 or Wayland calls to spawn windows that do not appear on active displays, or use of nohup/screen/tmux to mask interactive shells.
auditd:EXECVE
Execution of GUI-related binaries with suppressed window/display flags
auditd:SYSCALL
Use of fork/exec with DISPLAY unset or redirected
[DisplayScope]
Restrict monitoring to interactive GUI contexts rather than server/headless processes.
AN0362
Analytic 0362
macOS
Modification of plist files to set apple.awt.UIElement or similar flags hiding app icons and windows, and dscl/command-line activity that suppresses visibility. Defender view: correlation of plist modifications with unexpected hidden user applications.
macos:unifiedlog
Modification of plist with apple.awt.UIElement set to TRUE
macos:unifiedlog
Execution of Java apps or other processes with hidden window attributes
[PlistScope]
Restrict detection to application plists where UIElement flag is unexpected.
[UserContext]
Correlate plist modifications with the creating/modifying user to tune results.