value:  CopyKittens has used -w hidden and -windowstyle hidden to conceal PowerShell windows. ;; DarkHydrus has used -WindowStyle Hidden to conceal PowerShell windows. ;; Deep Panda has used -w hidden to conceal PowerShell windows by setting the WindowStyle parameter to hidden. ;; Gorgon Group has used -W Hidden to conceal PowerShell windows by setting the WindowStyle parameter to hidden. ;; HAMMERTOSS has used -WindowStyle hidden to conceal PowerShell windows. ;; Higaisa used a payload that creates a hidden window. ;; HotCroissant has the ability to hide the window for operations performed on a given file. ;; InvisiMole has executed legitimate tools in hidden windows. ;; KeyBoy uses -w Hidden to conceal a PowerShell window that downloads a payload. ;; Kivars has the ability to conceal its activity through hiding active windows. ;; Magic Hound malware has a function to determine whether the C2 server wishes to execute the newly dropped file in a hidden window. ;; MCMD can modify processes to prevent them from being visible on the desktop. ;; Metamorfo has hidden its GUI using the ShowWindow() WINAPI call. ;; PowerShower has added a registry key so future powershell.exe instances are spawned with coordinates for a window position off-screen by default. ;; StrongPity has the ability to hide the console window for its document search module from the user. ;; Ursnif droppers have used COM properties to execute malware in hidden windows. ;; WindTail can instruct the OS to execute an application without a dock icon or menu.
name: Hide Artifacts: Hidden Window