Live Active security incident? Get immediate response
MITRE ATT&CK® Technique

T1010: Application Window Discovery

Adversaries may attempt to get a listing of open application windows. Window listings could convey information about how the system is used.[1] For example, information about application windows could be used identify potential data to collect as well as identifying security tooling (Security Software Discovery) to evade.[2]

Adversaries typically abuse system features for this type of enumeration. For example, they may gather information through native system features such as Command and Scripting Interpreter commands and Native API functions.

EnterpriseT1010TechniqueObject v1.3 Modified
Discuss defensive coverage Back to ATT&CK
Glexia's Take

Analyst context for executives and security teams

Analyst confidence Medium

Application Window Discovery is a low-noise discovery behavior where an intruder or malware checks what windows are open on a Linux, macOS, or Windows endpoint. The business value is not the window list itself; it is what that list can reveal: user activity, potential sensitive data to collect, and whether security tools are visible. For leaders, this technique matters because it can be an early sign that a compromised endpoint is being assessed for surveillance, data collection, or evasion decisions.

Executive priority

Treat this as a validation point for endpoint visibility and incident triage, not as a standalone high-severity event. Security leaders should ask whether SOC tooling can see script-based and API-based local discovery across managed workstations and servers, and whether IR playbooks correlate this behavior with other discovery, collection, or security software discovery activity. The relationship context includes multiple remote access tools and espionage-oriented software, plus groups listed by ATT&CK as using the technique, so coverage is useful evidence for managed detection readiness and audit discussions around endpoint monitoring.

Technical view

ATT&CK places T1010 under Discovery for Linux, macOS, and Windows. The description states adversaries may abuse native system features, including Command and Scripting Interpreter behavior and Native API functions, to list open application windows. Since official MITRE detection text is not provided, defenders should validate coverage through the related detection strategy DET0097, Detection of Application Window Enumeration via API or Scripting, and by testing whether endpoint telemetry captures suspicious enumeration performed by scripts, interpreters, or unusual processes. Correlate with T1518.001 Security Software Discovery where window names reveal security tooling, and with follow-on collection or evasion behaviors when present.

Likely telemetry

  • Endpoint process creation and command-line telemetry for shells, scripting interpreters, and unusual parent-child process chains
  • Script execution logs where available, including local enumeration commands or automation frameworks
  • EDR or endpoint sensor telemetry for native API calls associated with window enumeration
  • Process metadata and user-session context showing which process performed enumeration and under which user
  • Application/window title metadata if collected by approved endpoint monitoring tools

Detection direction

  • Validate DET0097-style coverage for API-based and scripting-based application window enumeration rather than relying only on command-line indicators.
  • Tune detections around context: user-driven accessibility tools, helpdesk utilities, window managers, and legitimate automation may enumerate windows, so suspicious parent process, execution path, user context, and timing matter.
  • Prioritize alerts when enumeration is performed by newly observed binaries, remote access tools, scripts launched from unusual locations, or processes already associated with other discovery activity.
  • Look for relationship-driven context: ATT&CK maps this technique to numerous RATs/backdoors such as PoisonIvy, NETWIRE, QuasarRAT, Remcos, njRAT, and others, but do not infer a specific family from T1010 alone.
  • Check cross-platform blind spots. Windows coverage may be stronger than Linux/macOS depending on endpoint sensor depth, while API-level enumeration may not be visible in basic operating system logs.

Mitigation priorities

  • Ensure managed endpoints on Linux, macOS, and Windows have process, script, and endpoint behavior telemetry sufficient to support discovery detection.
  • Restrict and monitor unnecessary scripting capability where business operations allow, especially for high-risk users and sensitive systems.
  • Harden endpoint controls so untrusted or newly introduced tools cannot freely execute reconnaissance behavior without inspection.
  • Use application control, least privilege, and endpoint protection policies to reduce abuse of remote access tools and unauthorized automation.
  • Include this behavior in IR triage runbooks as a correlation signal with broader discovery, security software discovery, collection, and remote access activity.
Analyst notes and limits

This take is based on ATT&CK T1010 version 1.3 in enterprise-attack and the supplied relationship context. The most actionable relationship is DET0097, which frames detection around API or scripting enumeration. ATT&CK also lists multiple groups and software families as using this behavior, including Lazarus Group, HEXANE, Volt Typhoon, and many RAT/backdoor tools; those relationships support prioritizing detection engineering but should not be used as attribution by themselves.

MITRE provides no official detection text for this object in the supplied fields. Specific APIs, commands, event IDs, and vendor detections are not supplied, so local validation must be based on the organization’s endpoint sensor capabilities, logging policy, operating systems, and legitimate administrative tooling. T1010 alone is usually contextual rather than conclusive.

Official MITRE ATT&CK definition

Application Window Discovery

Adversaries may attempt to get a listing of open application windows. Window listings could convey information about how the system is used.[1] For example, information about application windows could be used identify potential data to collect as well as identifying security tooling (Security Software Discovery) to evade.[2]

Adversaries typically abuse system features for this type of enumeration. For example, they may gather information through native system features such as Command and Scripting Interpreter commands and Native API functions.

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

Associated objects

Groups, software, and campaigns

Group Enterprise

G0032: Lazarus Group

Lazarus Group is a North Korean state-sponsored cyber threat group attributed to the Reconnaissance General Bureau (RGB). [1] [2] Lazarus Group has been active since at least 2009 and is reportedly responsible for the November 2014 destructive wiper attack on Sony Pictures Entertainment, identified by Novetta as part of Operation Blockbuster. Malware used by Lazarus Group correlates to other reported campaigns, including Operation Flame, Operation 1Mission, Operation Troy, DarkSeoul, and Ten Days of Rain.[3]

North Korea’s cyber operations have shown a consistent pattern of adaptation, forming and reorganizing units as national priorities shift. These units frequently share personnel, infrastructure, malware, and tradecraft, making it difficult to attribute specific operations with high confidence. Public reporting often uses “Lazarus Group” as an umbrella term for multiple North Korean cyber operators conducting espionage, destructive attacks, and financially motivated campaigns.[4][5][6]

Group Enterprise

G1017: Volt Typhoon

Volt Typhoon is a People's Republic of China (PRC) state-sponsored actor that has been active since at least 2021, primarily targeting critical infrastructure organizations in the US and its territories including Guam. Volt Typhoon's targeting and pattern of behavior have been assessed as pre-positioning to enable lateral movement to operational technology (OT) assets for potential destructive or disruptive attacks. Volt Typhoon has emphasized stealth in operations using web shells, living-off-the-land (LOTL) binaries, hands on keyboard activities, and stolen credentials.[1][2][3][4]. The group has leveraged compromised SOHO routers to proxy command and control traffic and obscure its infrastructure, activity associated with the KV botnet.[5].

Reporting indicates a separate initial access cluster, SYLVANITE, has been observed exploiting internet-facing edge devices and transferring access to Volt Typhoon, also tracked as VOLTZITE, for follow-on operations. [6]

Group Enterprise

G1001: HEXANE

HEXANE is a cyber espionage threat group that has targeted oil & gas, telecommunications, aviation, and internet service provider organizations since at least 2017. Targeted companies have been located in the Middle East and Africa, including Israel, Saudi Arabia, Kuwait, Morocco, and Tunisia. HEXANE's TTPs appear similar to APT33 and OilRig but due to differences in victims and tools it is tracked as a separate entity.[1][2][3][4]

Malware Enterprise

S0438: Attor

Attor is a Windows-based espionage platform that has been seen in use since 2013. Attor has a loadable plugin architecture to customize functionality for specific targets.[1]

Windows
Malware Enterprise

S0033: NetTraveler

NetTraveler is malware that has been used in multiple cyber espionage campaigns for basic surveillance of victims. The earliest known samples have timestamps back to 2005, and the largest number of observed samples were created between 2010 and 2013. [1]

Windows
Malware Enterprise

S0696: Flagpro

Flagpro is a Windows-based, first-stage downloader that has been used by BlackTech since at least October 2020. It has primarily been used against defense, media, and communications companies in Japan.[1]

Windows
Malware Enterprise

S0385: njRAT

njRAT is a remote access tool (RAT) that was first observed in 2012. It has been used by threat actors in the Middle East.[1]

Windows
Malware Enterprise

S1111: DarkGate

DarkGate first emerged in 2018 and has evolved into an initial access and data gathering tool associated with various criminal cyber operations. Written in Delphi and named "DarkGate" by its author, DarkGate is associated with credential theft, cryptomining, cryptotheft, and pre-ransomware actions.[1] DarkGate use increased significantly starting in 2022 and is under active development by its author, who provides it as a Malware-as-a-Service offering.[2]

Windows
Malware Enterprise

S0139: PowerDuke

PowerDuke is a backdoor that was used by APT29 in 2016. It has primarily been delivered through Microsoft Word or Excel attachments containing malicious macros. [1]

Windows
Malware Enterprise

S0260: InvisiMole

InvisiMole is a modular spyware program that has been used by the InvisiMole Group since at least 2013. InvisiMole has two backdoor modules called RC2FM and RC2CL that are used to perform post-exploitation activities. It has been discovered on compromised victims in the Ukraine and Russia. Gamaredon Group infrastructure has been used to download and execute InvisiMole against a small number of victims.[1][2]

Windows
Malware Enterprise

S0531: Grandoreiro

Grandoreiro is a banking trojan written in Delphi that was first observed in 2016 and uses a Malware-as-a-Service (MaaS) business model. Grandoreiro has confirmed victims in Brazil, Mexico, Portugal, and Spain.[1][2]

Windows
Relationship explorer

All related ATT&CK context

uses · Malware S0438: Attor Enterprise uses · Malware S0033: NetTraveler Enterprise uses · Malware S0454: Cadelspy Enterprise uses · Malware S0696: Flagpro Enterprise uses · Malware S0385: njRAT Enterprise uses · Group G0032: Lazarus Group Enterprise uses · Malware S0094: Trojan.Karagany Enterprise uses · Malware S1111: DarkGate Enterprise uses · Malware S0673: DarkWatchman Enterprise uses · Malware S0139: PowerDuke Enterprise uses · Malware S0260: InvisiMole Enterprise uses · Malware S0456: Aria-body Enterprise uses · Malware S0531: Grandoreiro Enterprise detects · Detection Strategy DET0097: Detection of Application Window Enumeration via API or Scripting Enterprise uses · Malware S1239: TONESHELL Enterprise uses · Malware S0219: WINERACK Enterprise uses · Malware S0409: Machete Enterprise uses · Malware S1090: NightClub Enterprise uses · Malware S0198: NETWIRE Enterprise uses · Malware S0265: Kazuar Enterprise uses · Malware S0375: Remexi Enterprise uses · Malware S1159: DUSTTRAP Enterprise uses · Malware S0157: SOUNDBITE Enterprise uses · Malware S0038: Duqu Enterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .

ATT&CK release
19.1
Object version
1.3
Created
Modified
Raw hash
0d3ad4453e507f4a...
Imported snapshots across ATT&CK releases (1)
Release Bundle imported Object version Modified Status Raw hash
19.1 1.3 Current bundle 0d3ad4453e50…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSON Open MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    Prevailion DarkWatchman 2021

    Smith, S., Stafford, M. (2021, December 14). DarkWatchman: A new evolution in fileless techniques. Retrieved January 10, 2022.

    Open source URL
  2. [2]
    ESET Grandoreiro April 2020

    ESET. (2020, April 28). Grandoreiro: How engorged can an EXE get?. Retrieved November 13, 2020.

    Open source URL
  3. [3]
    mitre-attack T1010
    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK site Official STIX data repository MITRE ATT&CK terms of use