T1010 — Application Window Discovery

Tactic: Discovery · Platforms: Linux, macOS, Windows

Adversaries may attempt to get a listing of open application windows. Window listings could convey information about how the system is used. For example, information about application windows could be used identify potential data to collect as well as identifying security tooling (Security…

Sigma detection rules (3)

T1010 Application Window Discovery

title: T1010 Application Window Discovery
id: a700bb21-ba95-44d0-ae15-6030c48430aa
description: 'Detection of Application Window Enumeration via API or Scripting. (Corrected logsource category to ps_script - this technique is captured via PowerShell Script Block Logging (EventID 4104), not Sysmon process_creation telemetry.) Tune using: AccessedFunction, UserContext, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1010
author: Shahrukh Khan
date: 2026-02-27
license: MIT
tags:
  - attack.discovery
  - attack.t1010

logsource:
  category: ps_script
  product: windows
  service: powershell

detection:
  selection:
    EventID: '4104'
    ScriptBlockText|contains:
      - 'EnumWindows'
      - 'MainWindowTitle'
      - 'GetForegroundWindow'

  condition: selection

falsepositives:
  - Legitimate automation/RPA scripts and accessibility tooling enumerate windows for entirely benign reasons; this technique has weak native Windows Event Log visibility outside PowerShell script-block logging.

level: informational

T1010 Application Window Discovery

title: T1010 Application Window Discovery
id: 8b1baa8a-5ce2-4a0d-a298-3a294cd4bad3
description: 'Detection of Application Window Enumeration via API or Scripting. (Retargeted to the process_creation auditd telemetry that actually captures this techniques behavior; see logsource below.) Tune using: ExecutableName, DisplayContext.'
references:
  - https://attack.mitre.org/techniques/T1010
author: Shahrukh Khan
date: 2026-01-13
license: MIT
tags:
  - attack.discovery
  - attack.t1010

logsource:
  category: process_creation
  product: linux

detection:
  selection:
    type: EXECVE
    a0|endswith:
      - '/wmctrl'
      - '/xdotool'
  condition: selection

falsepositives:
  - Legitimate window-management automation/scripting on Linux desktops; this technique has minimal applicability to typical headless Linux servers.

level: low

T1010 Application Window Discovery

title: T1010 Application Window Discovery
id: cc8b78d8-115f-4785-9df0-6c0251ee65aa
description: 'Detection of Application Window Enumeration via API or Scripting. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: AppleScriptTarget, ParentProcess.'
references:
  - https://attack.mitre.org/techniques/T1010
author: Shahrukh Khan
date: 2026-06-06
license: MIT
tags:
  - attack.discovery
  - attack.t1010

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|endswith: '/osascript'
    CommandLine|contains|all:
      - 'System Events'
      - 'windows'
  condition: selection

falsepositives:
  - Accessibility or window-management automation utilities that legitimately enumerate open application windows.

level: informational

Explore