kevmap

TechniquesT1564.003 › AN0361

AN0361 Analytic 0361

Linux · attack.mitre.org · ATT&CK Enterprise v19.2

<p>Suspicious invocation of GUI utilities or scripts with suppressed or redirected windowing options. Defender view: detection of X11 or Wayland calls to spawn windows that do not appear on active displays, or use of nohup/screen/tmux to mask interactive shells.</p>
Detects
T1564.003 Hidden Window
Part of
DET0128 Detection Strategy for Hidden Windows

Log sources and channels

Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.

Log sourceChannelData component
auditd:EXECVEExecution of GUI-related binaries with suppressed window/display flagsDC0064 Command Execution
auditd:SYSCALLUse of fork/exec with DISPLAY unset or redirectedDC0034 Process Metadata

Mutable elements

Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.

FieldDescription
DisplayScopeRestrict monitoring to interactive GUI contexts rather than server/headless processes.