Cross-source coverage
T1010 / ATT&CK
Application Window Discovery
2 rules across 2 sources.
From MITRE ATT&CK 19.2
Adversaries may attempt to get a listing of open application windows. Window listings could convey information about how the system is used. For example, information about application windows could be used identify potential data to collect as well as identifying security tooling (Security Software Discovery) to evade.
Adversaries typically abuse system features for this type of enumeration. For example, they may gather information through native system features such as Command and Scripting Interpreter commands and Native API functions.
- Tactics
- Discovery
- Platforms
- Linux · macOS · Windows
- Telemetry
-
WinEventLog:SysmonWinEventLog:PowerShellauditd:EXECVElinus:syslogmacos:unifiedlogmacos:osquery
How MITRE says to detect it DET0097
Detection of Application Window Enumeration via API or Scripting
Windows Analytic 0271
Processes using Win32 API calls (e.g., EnumWindows, GetForegroundWindow) or scripting tools (e.g., PowerShell, VBScript) to enumerate open windows. These often appear with reconnaissance or data collection TTPs.
WinEventLog:SysmonEventCode=10WinEventLog:PowerShellEventCode=4103, 4104, 4105, 4106
Linux Analytic 0272
Scripted or binary usage of X11 utilities (e.g., xdotool, wmctrl) or direct /proc/*/window mappings to discover open GUI windows and active desktops.
auditd:EXECVEexecvelinus:syslogNone
macOS Analytic 0273
Processes that utilize AppleScript, `CGWindowListCopyWindowInfo`, or `NSRunningApplication` APIs to list active application windows and foreground processes.
macos:unifiedlogNonemacos:osqueryprocess_events
SigmaHQ/sigma
1 rule| Detection | Severity | Format |
|---|---|---|
| SCM Database Handle Failure | Medium | Sigma |
socfortress/Wazuh-Rules
1 rule| Detection | Severity | Format |
|---|---|---|
| Sysmon - Event 1: Process creation · csc.exe Used to Compile Window Discovery Tool (T1010) | High | Wazuh XML |