T1010 Application Window Discovery
EnterpriseAdversaries may attempt to get a listing of open application windows. Window listings could convey information about how the system is used. For example, information about application windows could be used identify potential data to collect as well as identifying security tooling (Security Software Discovery) to evade. Adversaries typically abuse system features for this type of enumeration. For example, they may gather information through native system features such as Command and Scripting Interpreter commands and Native API functions.
platforms
Platforms this applies to.
tactics
ATT&CK tactics this technique serves.
detected by (4)
Data components that detect this.
countered by (D3FEND)
D3FEND countermeasures that counter this.
groups (3)
Threat groups associated with this.
software (34)
Malware and tools associated with this.
Detected by (Sigma) (1)
Sigma detection rules related to this.
source
Where this definition is published.