Technique.View on attack.mitre.org
Adversaries may attempt to get a listing of open application windows. Window listings could convey information about how the system is used. For example, information about application windows could be used identify potential data to collect as well as identifying security tooling (Security Software Discovery) to evade.
Adversaries typically abuse system features for this type of enumeration. For example, they may gather information through native system features such as Command and Scripting Interpreter commands and Native API functions.
Rules on DetectionCode tagged with T1010.
| Rule | Level | Log source |
|---|---|---|
| SCM Database Handle Failure | medium | windows / NULL |
None recorded.
| Used by | Procedure example |
|---|---|
| GroupHEXANE | HEXANE has used a PowerShell-based keylogging tool to capture the window title. |
| GroupLazarus Group | Lazarus Group malware IndiaIndia obtains and sends to its C2 server the title of the window for each running process. The KilaAlfa keylogger also reports the title of the window in the foreground. |
| GroupVolt Typhoon | Volt Typhoon has collected window title information from compromised systems. |
| Used by | Procedure example |
|---|---|
| MalwareAria-body | Aria-body has the ability to identify the titles of running windows on a compromised host. |
| MalwareAttor | Attor can obtain application window titles and then determines which windows to perform Screen Capture on. |
| MalwareCadelspy | Cadelspy has the ability to identify open windows on the compromised host. |
| MalwareCatchamas | Catchamas obtains application windows titles and then determines which windows to perform Screen Capture on. |
| MalwareDarkGate | DarkGate will search for cryptocurrency wallets by examining application window names for specific strings. DarkGate extracts information collected via NirSoft tools from the hosting process's memory by first identifying the window through the |
| MalwareDarkWatchman | DarkWatchman reports window names along with keylogger information to provide application context. |
| MalwareDuqu | The discovery modules used with Duqu can collect information on open windows. |
| MalwareDUSTTRAP | DUSTTRAP can enumerate running application windows. |
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
