subprocess.run was already patched with CREATE_NO_WINDOW, but Popen and os.startfile were unprotected. Agent code could open visible GUI windows via subprocess.Popen(['notepad.exe']) or os.startfile().
subprocess.run was already patched with CREATE_NO_WINDOW, but Popen and os.startfile were unprotected. Agent code could open visible GUI windows via subprocess.Popen(['notepad.exe']) or os.startfile().