H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Technique

Application Window Discovery

Adversaries may attempt to get a listing of open application windows. Window listings could convey information about how the system is used.(Citation: Prevailion DarkWatchman 2021) For example, information about application windows could be used identify potential data to collect as well as identifying security tooling ([Security Software Discovery](https://attack.mitre.org/techniques/T1518/001)) to evade.(Citation: ESET Grandoreiro April 2020) Adversaries typically abuse system features for this type of enumeration. For example, they may gather information through native system features such as [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059) commands and [Native API](https://attack.mitre.org/techniques/T1106) functions.

Technique
TypeTechnique
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

Adversaries may attempt to get a listing of open application windows. Window listings could convey information about how the system is used.(Citation: Prevailion DarkWatchman 2021) For example, information about application windows could be used identify potential data to collect as well as identifying security tooling ([Security Software Discovery](https://attack.mitre.org/techniques/T1518/001)) to evade.(Citation: ESET Grandoreiro April 2020) Adversaries typically abuse system features for this type of enumeration. For example, they may gather information through native system features such as [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059) commands and [Native API](https://attack.mitre.org/techniques/T1106) functions.

37 recorded

Relationships

uses
from Aria-body
Malware
uses
from Attor
Malware
uses
from Cadelspy
Malware
uses
from Catchamas
Malware
uses
from DarkGate
Malware
uses
from DarkWatchman
Malware
uses
from Duqu
Malware
uses
from DUSTTRAP
Malware
uses
from Flagpro
Malware
uses
from FunnyDream
Malware
uses
from Grandoreiro
Malware
uses
from HEXANE
Group
uses
from HotCroissant
Malware
uses
from InvisiMole
Malware
uses
from Kazuar
Malware
uses
from Lazarus Group
Group
uses
from Machete
Malware
uses
from Metamorfo
Malware
uses
from NetTraveler
Malware
uses
from NETWIRE
Malware
uses
from NightClub
Malware
uses
from njRAT
Malware
uses
from PAKLOG
Malware
uses
from PLEAD
Malware
uses
from PoisonIvy
Malware
uses
from PowerDuke
Malware
uses
from QakBot
Malware
uses
from QuasarRAT
Tool
uses
from Remcos
Tool
uses
from Remexi
Malware
uses
from ROKRAT
Malware
uses
from SILENTTRINITY
Tool
uses
from SOUNDBITE
Malware
uses
from TONESHELL
Malware
uses
from Trojan.Karagany
Malware
uses
from Volt Typhoon
Group
uses
from WINERACK
Malware
3 external

References

mitre-attack
T1010
open
ESET Grandoreiro April 2020
https://www.welivesecurity.com/2020/04/28/grandoreiro-how-engorged-can-exe-get/
open
Prevailion DarkWatchman 2021
https://web.archive.org/web/20220629230035/https://www.prevailion.com/darkwatchman-new-fileless-techniques/
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance