T1010 Application Window Discovery

discovery — Linux, macOS, Windows · attack.mitre.org · JSON

MITRE detection strategy

analytics

Sigma rules tagged attack.t1010

KEV CVEs mapped here

<p>Adversaries may attempt to get a listing of open application windows. Window listings could convey information about how the system is used. For example, information about application windows could be used identify potential data to collect as well as identifying security tooling (Security Software Discovery) to evade.</p><p>Adversaries typically abuse system features for this type of enumeration. For example, they may gather information through native system features such as Command and Scripting Interpreter commands and Native API functions.</p>

KEV CVEs mapped to this technique · CTID Mappings Explorer

None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.

Detection strategy · ATT&CK Enterprise v19.2

DET0097 Detection of Application Window Enumeration via API or Scripting v1.0
AN0271 Windows
Processes using Win32 API calls (e.g., EnumWindows, GetForegroundWindow) or scripting tools (e.g., PowerShell, VBScript) to enumerate open windows. These often appear with reconnaissance or data collection TTPs.

WinEventLog:Sysmon EventCode=10 → DC0035 Process Access
WinEventLog:PowerShell EventCode=4103, 4104, 4105, 4106 → DC0064 Command Execution

Tunable: AccessedFunction UserContext TimeWindow

AN0272 Linux
Scripted or binary usage of X11 utilities (e.g., xdotool, wmctrl) or direct /proc/*/window mappings to discover open GUI windows and active desktops.

auditd:EXECVE execve → DC0032 Process Creation
linus:syslog None → DC0064 Command Execution

Tunable: ExecutableName DisplayContext

AN0273 macOS
Processes that utilize AppleScript, CGWindowListCopyWindowInfo, or NSRunningApplication APIs to list active application windows and foreground processes.

macos:unifiedlog None → DC0021 OS API Execution
macos:osquery process_events → DC0032 Process Creation

Tunable: AppleScriptTarget ParentProcess

Sigma rules · SigmaHQ da9bb07d64, tag `attack.t1010`

SCM Database Handle Failure mediumtest

Author: Roberto Rodriguez @Cyb3rWard0g · 2019-08-12 (modified 2022-07-11) · logsource: product=windows service=security · 13addce7-47b2-4ca0-a98f-1de964d1d669

Detects non-system users failing to get a handle of the SCM database.

Techniques: T1010

T1010 Application Window Discovery

KEV CVEs mapped to this technique · CTID Mappings Explorer

Detection strategy · ATT&CK Enterprise v19.2

Sigma rules · SigmaHQ da9bb07d64, tag attack.t1010

Sigma rules · SigmaHQ da9bb07d64, tag `attack.t1010`