tfMITRE ATT&CK technique

Application Window Discovery T1010

Tactic: Discovery
Platforms: Linux, macOS, Windows
Version: 1.3
Created: 31 May 2017
Last modified: 12 May 2026

Adversaries may attempt to get a listing of open application windows. Window listings could convey information about how the system is used.[1] For example, information about application windows could be used identify potential data to collect as well as identifying security tooling (Security Software Discovery) to evade.[2]

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups64th pct

Threat groups64th percentile · 64% of ATT&CK techniques have this many threat groups attributed or fewer.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malwareTop 11%

Tools & malware89th percentile · 89% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rules42nd pct

Detection rules42nd percentile · 58% of ATT&CK techniques have more detection rules written.

Application Window Discovery MITRE reference T1010

64th pctamong all ATT&CK techniques for number of groups

3 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

Volt TyphoonG1017 ↗

Has collected window title information from compromised systems.1

created 2023-07-271 referenceaka BRONZE SILHOUETTE

HEXANEG1001 ↗

Has used a PowerShell-based keylogging tool to capture the window title.1

created 2018-10-171 referenceaka Lyceum

Lazarus GroupG0032 ↗

Malware IndiaIndia obtains and sends to its C2 server the title of the window for each running process. The KilaAlfa keylogger also reports the title of the window in the foreground.1 2 3

created 2017-05-313 referencesaka Labyrinth Chollima

All 3 groups for this technique

34 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.

TONESHELLS1239 ↗

Has used GetForegroundWindow to detect virtualization or sandboxes by calling the API twice and comparing each window handle.1

created 2025-09-15MALWAREcarried by 1 group

PAKLOGS1233 ↗

Has used GetForegroundWindow to access the foreground window. 1 PAKLOG has also captured text from the foreground windows.1

created 2025-09-12MALWAREcarried by 1 group

DUSTTRAPS1159 ↗

Can enumerate running application windows.1

created 2024-09-16MALWAREcarried by 1 group

DarkGateS1111 ↗

Will search for cryptocurrency wallets by examining application window names for specific strings.1 DarkGate extracts information collected via NirSoft tools from the hosting process's memory by first identifying the window through the FindWindow API function.1

created 2024-02-09MALWARE

NightClubS1090 ↗

Can use GetForegroundWindow to enumerate the active window.1

created 2023-09-27MALWAREcarried by 1 group

FunnyDreamS1044 ↗

Has the ability to discover application windows via execution of EnumWindows.1

created 2022-09-23MALWARE

All 34 software entries for this technique · 6 newest in this preview

Offense vs defense T1010

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 0Sigma rules (cumulative) · 1Splunk ESCU (cumulative) · 0

first rule: 2019 Q3

Application Window Discovery detection strategy DET0097

MITRE names one behaviour worth catching for this technique and breaks it into 3 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection of Application Window Enumeration via API or Scripting

Enterprise

3 platforms

AN0271 · Windows

Processes using Win32 API calls (e.g., EnumWindows, GetForegroundWindow) or scripting tools (e.g., PowerShell, VBScript) to enumerate open windows. These often appear with reconnaissance or data collection TTPs.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process AccessDC0035	WinEventLog:Sysmon	EventCode=10
Command ExecutionDC0064	WinEventLog:PowerShell	EventCode=4103, 4104, 4105, 4106

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
AccessedFunction	Tune to focus on suspicious function calls (e.g., user32.dll!EnumWindows).
UserContext	Detect behavior from non-interactive or low-privileged users where enumeration is uncommon.
TimeWindow	Shorten detection scope to rapid successive window enumeration attempts.

AN0272 · Linux

Scripted or binary usage of X11 utilities (e.g., xdotool, wmctrl) or direct /proc/*/window mappings to discover open GUI windows and active desktops.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	auditd:EXECVE	execve
Command ExecutionDC0064	linus:syslog	None

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ExecutableName	Common window management utilities can be tuned to reduce noise (e.g., xprop, xwininfo).
DisplayContext	Restrict detection to processes executing under graphical sessions (e.g., DISPLAY=:0).

AN0273 · macOS

Processes that utilize AppleScript, CGWindowListCopyWindowInfo, or NSRunningApplication APIs to list active application windows and foreground processes.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
OS API ExecutionDC0021	macos:unifiedlog	None
Process CreationDC0032	macos:osquery	process_events

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
AppleScriptTarget	Tunable to ignore benign scripting like automation by known apps.
ParentProcess	Useful to suppress expected automation processes.

1 analytic

Certain commands are frequently used by malicious actors and infrequently used by normal users. By looking for execution of these commands in short periods of time, we can not only see when a malicious user was on the system but also get an idea of what they were doing.

TypeTTPCoverageLowSubmitted2013

D3FEND techniques

The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.

ID	Name
D3-PLA	Process Lineage Analysis

Data model references

The CAR data model objects, actions and fields the logic reads. Map these to your own schema before implementing.

Object	Action	Field
process	create	hostname
process	create	ppid
process	create	exe

Implementations

Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.

processes = search Process:Create
reg_processes = filter processes where (exe == "arp.exe" or exe == "at.exe" or exe == "attrib.exe"
 or exe == "cscript.exe" or exe == "dsquery.exe" or exe == "hostname.exe"
 or exe == "ipconfig.exe" or exe == "mimikatz.exe" or exe == "nbstat.exe"
 or exe == "net.exe" or exe == "netsh.exe" or exe == "nslookup.exe"
 or exe == "ping.exe" or exe == "quser.exe" or exe == "qwinsta.exe"
 or exe == "reg.exe" or exe == "runas.exe" or exe == "sc.exe"
 or exe == "schtasks.exe" or exe == "ssh.exe" or exe == "systeminfo.exe"
 or exe == "taskkill.exe" or exe == "telnet.exe" or exe == "tracert.exe"
 or exe == "wscript.exe" or exe == "xcopy.exe")
reg_grouped = group reg by hostname, ppid where(max time between two events is 30 minutes)
output reg_grouped

DNIF version of the above pseudocode.

_fetch * from event where $LogName=WINDOWS-SYSMON AND $EventID=1 AND $App=regex(arp\.exe|at\.exe|attrib\.exe|cscript\.exe|dsquery\.exe|hostname\.exe|ipconfig\.exe|mimikatz.exe|nbstat\.exe|net\.exe|netsh\.exe|nslookup\.exe|ping\.exe|quser\.exe|qwinsta\.exe|reg\.exe|runas\.exe|sc\.exe|schtasks\.exe|ssh\.exe|systeminfo\.exe|taskkill\.exe|telnet\.exe|tracert\.exe|wscript\.exe|xcopy\.exe)i group count_unique $App limit 100
>>_agg count
>>_checkif int_compare Count > 1 include

LogPoint version of the above pseudocode.

norm_id=WindowsSysmon event_id=1 image IN ["*\arp.exe", "*\at.exe", "*\attrib.exe", "*\cscript.exe", "*\dsquery.exe", "*\hostname.exe", "*\ipconfig.exe", "*\mimikatz.exe", "*\nbstat.exe", "*\net.exe", "*\netsh.exe", "*\nslookup.exe", "*\ping.exe", "*\quser.exe", "*\qwinsta.exe", "*\reg.exe", "*\runas.exe", "*\sc.exe", "*\schtasks.exe", "*\ssh.exe", "*\systeminfo.exe", "*\taskkill.exe", "*\telnet.exe", "*\tracert.exe", "*\wscript.exe", "*\xcopy.exe"]
| chart count() as cnt by host
| search cnt > 1

Unit tests

CAR’s own validation procedures for this analytic.

Within a command window, execute several of the commands in quick succession.

["ipconfig /all","hostname","systeminfo","reg.exe Query HKLM\\Software\\Microsoft"]

Tests1Executorscmd 1Need elevation0 of 1Have prerequisites1Have cleanup1Platformswindows

Test

Platform

Executor

Elevation

Prereqs

Cleanup

Ref

List Process Main Windows - C# .NET

windows

cmd

—

Yes

Compiles and executes C# code to list main window titles associated with each process. Upon successful execution, powershell will download the .cs from the Atomic Red Team repo, and cmd.exe will compile and execute T1010.exe. Upon T1010.exe execution, expected output will be via stdout.

Input arguments

Name	Type	Default	Description
output_file_name	string	%TEMP%\T1010.exe	Name of output binary
input_source_code	path	PathToAtomicsFolder\T1010\src\T1010.cs	Path to source of C# code

Attack command

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe -out:#{output_file_name} "#{input_source_code}"
#{output_file_name}

Cleanup command

del /f /q /s #{output_file_name} >nul 2>&1

Prerequisite

T1010.cs must exist on disk at specified location (#{input_source_code})

Check

if (Test-Path "#{input_source_code}") {exit 0} else {exit 1}

Satisfy

New-Item -Type Directory (split-path "#{input_source_code}") -ErrorAction ignore | Out-Null
Invoke-WebRequest https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1010/src/T1010.cs -OutFile "#{input_source_code}"

GUIDe7f01bb3-4209-488c-aafc-03a229325aeb

Tests from Atomic Red Team (MIT licence) · technique definition

Application Window Discovery detections T1010

1 rule is mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

42nd pctamong all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs