MITRE ATT&CKtechnique

T1010 Application Window Discovery

Published 2017-05-31 Modified 2026-05-12 Official page ↗
Domain
enterprise
Tactics
Discovery
Platforms
Linux, macOS, Windows
Version
1.3
Created
2017-05-31

Description

Adversaries may attempt to get a listing of open application windows. Window listings could convey information about how the system is used. For example, information about application windows could be used identify potential data to collect as well as identifying security tooling (Security Software Discovery) to evade. Adversaries typically abuse system features for this type of enumeration. For example, they may gather information through native system features such as Command and Scripting Interpreter commands and Native API functions.

Related

Tactic · MITRE ATT&CK (1)

Referenced by MITRE ATT&CK · uses (37)

  • S1239 TONESHELL software (malware)
  • S1233 PAKLOG software (malware)
  • S1159 DUSTTRAP software (malware)
  • S1111 DarkGate software (malware)
  • S1090 NightClub software (malware)
  • G1017 Volt Typhoon group
  • S1044 FunnyDream software (malware)
  • S0696 Flagpro software (malware)
  • S0692 SILENTTRINITY software (tool)
  • S0673 DarkWatchman software (malware)
  • S0650 QakBot software (malware)
  • S0531 Grandoreiro software (malware)
  • S0455 Metamorfo software (malware)
  • S0456 Aria-body software (malware)
  • S0454 Cadelspy software (malware)
  • S0435 PLEAD software (malware)
  • S0438 Attor software (malware)
  • S0431 HotCroissant software (malware)
  • S0409 Machete software (malware)
  • S0385 njRAT software (malware)
  • S0375 Remexi software (malware)
  • S0332 Remcos software (tool)
  • G1001 HEXANE group
  • S0240 ROKRAT software (malware)
  • S0260 InvisiMole software (malware)
  • S0261 Catchamas software (malware)
  • S0262 QuasarRAT software (tool)
  • S0265 Kazuar software (malware)
  • S0198 NETWIRE software (malware)
  • S0219 WINERACK software (malware)
Show all 37 ›

References