tfMITRE ATT&CK technique

Application Window Discovery T1010

Tactic: Discovery
Platforms: Linux, macOS, Windows
Version: 1.3
Created: 31 May 2017
Last modified: 12 May 2026

Adversaries may attempt to get a listing of open application windows. Window listings could convey information about how the system is used.[1] For example, information about application windows could be used identify potential data to collect as well as identifying security tooling (Security Software Discovery) to evade.[2]

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups64th pct

Threat groups64th percentile · 56% of ATT&CK techniques have fewer threat groups attributed.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malwareTop 11%

Tools & malware89th percentile · 89% of ATT&CK techniques have fewer tools implementing them.

Detection rules42nd pct

Detection rules42nd percentile · 58% of ATT&CK techniques have more detection rules written.

tfMITRE ATT&CK technique

Application Window Discovery T1010

Tactic: Discovery
Platforms: Linux, macOS, Windows
Version: 1.3
Created: 31 May 2017
Last modified: 12 May 2026

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups64th pct

Threat groups64th percentile · 56% of ATT&CK techniques have fewer threat groups attributed.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malwareTop 11%

Tools & malware89th percentile · 89% of ATT&CK techniques have fewer tools implementing them.

Detection rules42nd pct

Detection rules42nd percentile · 58% of ATT&CK techniques have more detection rules written.

Application Window Discovery MITRE reference T1010

64th pctamong all ATT&CK techniques for number of groups

3 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

Volt TyphoonG1017 ↗

Has collected window title information from compromised systems.1

created 2023-07-271 referenceaka BRONZE SILHOUETTE

HEXANEG1001 ↗

Has used a PowerShell-based keylogging tool to capture the window title.1

created 2018-10-171 referenceaka Lyceum

Lazarus GroupG0032 ↗

Malware IndiaIndia obtains and sends to its C2 server the title of the window for each running process. The KilaAlfa keylogger also reports the title of the window in the foreground.1 2 3

created 2017-05-313 referencesaka Labyrinth Chollima

All 3 groups for this technique

34 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.

TONESHELLS1239 ↗

Has used GetForegroundWindow to detect virtualization or sandboxes by calling the API twice and comparing each window handle.1

created 2025-09-15MALWAREcarried by 1 group

PAKLOGS1233 ↗

Has used GetForegroundWindow to access the foreground window. 1 PAKLOG has also captured text from the foreground windows.1

created 2025-09-12MALWAREcarried by 1 group

DUSTTRAPS1159 ↗

Can enumerate running application windows.1

created 2024-09-16MALWAREcarried by 1 group

DarkGateS1111 ↗

Will search for cryptocurrency wallets by examining application window names for specific strings.1 DarkGate extracts information collected via NirSoft tools from the hosting process's memory by first identifying the window through the FindWindow API function.1

created 2024-02-09MALWARE

NightClubS1090 ↗

Can use GetForegroundWindow to enumerate the active window.1

created 2023-09-27MALWAREcarried by 1 group

FunnyDreamS1044 ↗

Has the ability to discover application windows via execution of EnumWindows.1

created 2022-09-23MALWARE

All 34 software entries for this technique · 6 newest in this preview

Data component	Name	Channel
Process AccessDC0035	WinEventLog:Sysmon	EventCode=10
Command ExecutionDC0064	WinEventLog:PowerShell	EventCode=4103, 4104, 4105, 4106

Data component

Name

Channel

Process AccessDC0035

WinEventLog:Sysmon

EventCode=10

Command ExecutionDC0064

WinEventLog:PowerShell

EventCode=4103, 4104, 4105, 4106

Field	What you tune
AccessedFunction	Tune to focus on suspicious function calls (e.g., user32.dll!EnumWindows).
UserContext	Detect behavior from non-interactive or low-privileged users where enumeration is uncommon.
TimeWindow	Shorten detection scope to rapid successive window enumeration attempts.

Field

What you tune

AccessedFunction

Tune to focus on suspicious function calls (e.g., user32.dll!EnumWindows).

UserContext

Detect behavior from non-interactive or low-privileged users where enumeration is uncommon.

TimeWindow

Shorten detection scope to rapid successive window enumeration attempts.

Data component	Name	Channel
Process CreationDC0032	auditd:EXECVE	execve
Command ExecutionDC0064	linus:syslog	—

Field	What you tune
ExecutableName	Common window management utilities can be tuned to reduce noise (e.g., xprop, xwininfo).
DisplayContext	Restrict detection to processes executing under graphical sessions (e.g., DISPLAY=:0).

Data component	Name	Channel
OS API ExecutionDC0021	macos:unifiedlog	—
Process CreationDC0032	macos:osquery	process_events

Data component

Name

Channel

OS API ExecutionDC0021

macos:unifiedlog

—

Process CreationDC0032

macos:osquery

process_events

Field	What you tune
AppleScriptTarget	Tunable to ignore benign scripting like automation by known apps.
ParentProcess	Useful to suppress expected automation processes.

Field

What you tune

AppleScriptTarget

Tunable to ignore benign scripting like automation by known apps.

ParentProcess

Useful to suppress expected automation processes.

ID	Name
D3-PLA	Process Lineage Analysis

Name

D3-PLA

Process Lineage Analysis

Object	Action	Field
process	create	hostname
process	create	ppid
process	create	exe

Object

Action

Field

processes = search Process:Create reg_processes = filter processes where (exe == "arp.exe" or exe == "at.exe" or exe == "attrib.exe" or exe == "cscript.exe" or exe == "dsquery.exe" or exe == "hostname.exe" or exe == "ipconfig.exe" or exe == "mimikatz.exe" or exe == "nbstat.exe" or exe == "net.exe" or exe == "netsh.exe" or exe == "nslookup.exe" or exe == "ping.exe" or exe == "quser.exe" or exe == "qwinsta.exe" or exe == "reg.exe" or exe == "runas.exe" or exe == "sc.exe" or exe == "schtasks.exe" or exe == "ssh.exe" or exe == "systeminfo.exe" or exe == "taskkill.exe" or exe == "telnet.exe" or exe == "tracert.exe" or exe == "wscript.exe" or exe == "xcopy.exe") reg_grouped = group reg by hostname, ppid where(max time between two events is 30 minutes) output reg_grouped

norm_id=WindowsSysmon event_id=1 image IN ["*\arp.exe", "*\at.exe", "*\attrib.exe", "*\cscript.exe", "*\dsquery.exe", "*\hostname.exe", "*\ipconfig.exe", "*\mimikatz.exe", "*\nbstat.exe", "*\net.exe", "*\netsh.exe", "*\nslookup.exe", "*\ping.exe", "*\quser.exe", "*\qwinsta.exe", "*\reg.exe", "*\runas.exe", "*\sc.exe", "*\schtasks.exe", "*\ssh.exe", "*\systeminfo.exe", "*\taskkill.exe", "*\telnet.exe", "*\tracert.exe", "*\wscript.exe", "*\xcopy.exe"] | chart count() as cnt by host | search cnt > 1

Application Window Discovery T1010

Application Window Discovery T1010

Application Window Discovery MITRE reference T1010

Application Window Discovery MITRE reference T1010

Offense vs defense T1010

Application Window Discovery detection strategy DET0097

Detection of Application Window Enumeration via API or Scripting

Log sources

Tunable fields

Log sources

Tunable fields

Log sources

Tunable fields

D3FEND techniques

Data model references

Implementations

Unit tests

Application Window Discovery detections T1010

Application Window Discovery detections T1010