Application Window Discovery (T1010) is a discovery technique. Adversaries try to get a list of open application windows. MITRE lists Linux, macOS and Windows.
How attackers use it
MITRE says a window list can tell an adversary how the system is used. It can help identify data worth collecting, and it can identify security tools to evade. Adversaries typically abuse system features for this, such as command and scripting interpreter commands and native API functions.
How to detect it
MITRE's analytic names what to look for on each platform:
- Windows: processes using Win32 API calls such as EnumWindows and GetForegroundWindow, or scripting tools like PowerShell and VBScript, to list open windows.
- Linux: use of X11 utilities such as xdotool and wmctrl, or window mappings under /proc.
- macOS: AppleScript, CGWindowListCopyWindowInfo, or NSRunningApplication used to list active windows and foreground processes.
API calls rarely show up in standard logs, so lean on endpoint tools that record API use, and on script logging such as PowerShell script block logging. MITRE notes these calls often appear alongside reconnaissance or data collection. A script that lists windows and then captures screens or reads files is a stronger signal than either alone.
How to reduce the risk
MITRE lists no mitigations for this technique, because it abuses legitimate system features. Aim at the stages around it: restrict script execution to what users need, and log script content.
Detection tips
Window listing is cheap for an adversary and nearly invisible in default logs. The best way to catch it is through the process doing it. A background service, a script host or a program with no user interface that lists windows is odd, because windows matter to programs that talk to a person. Alert on non-interactive processes that call window enumeration functions or run the matching scripts.
Pair it with what follows. MITRE says window data can identify data to collect and tools to evade. A window listing followed by screen capture, clipboard reads or an attempt to stop a security process tells the story.
Quick check
Why would an adversary want a window list?
It shows how the system is used, helps pick data to collect, and reveals security tools they may want to avoid.
