T1010 Application Window Discovery

Technique

T1010

Tactics

Discovery

Research, 90 days

4

KEV CVEs mapped

0

SigmaHQ rules

1

Elastic, Splunk

0

thrunt rules

0

Upstream

https://attack.mitre.org/techniques/T1010

MITRE description

Adversaries may attempt to get a listing of open application windows. Window listings could convey information about how the system is used.(Citation: Prevailion DarkWatchman 2021) For example, information about application windows could be used to identify potential data to collect as well as identifying security tooling ([Security Software Discovery](https://attack.mitre.org/techniques/T1518/001)) to evade.(Citation: ESET Grandoreiro April 2020) Adversaries typically abuse system features for this type of enumeration. For example, they may gather information through native system features such as [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059) commands and [Native API](https://attack.mitre.org/techniques/T1106) functions.

Research citing this technique

Reports and advisories from the last 90 days that cite this technique.

• 2026-10-22 Group-IB: Inside SiriusQT: A Seriously Skilled RAT
• 2026-10-14 Group-IB: KGB RAT: A Fully Undetectable Windows Trojan Built to Spy, Steal, and Terrorize
• 2026-10-02 Group-IB: Anatomía de BraZetsu: Cómo los cibercriminales abastecen el ecosistema clandestino
• 2026-08-31 Group-IB: Anatomy of BraZetsu: How Cybercriminals Fuel the Underground Ecosystem

Detection coverage

SigmaHQ community rules

• SCM Database Handle Failure (core)

Signal counts reflect the current corpus snapshot. Research citations are the technique IDs named in vendor reports and government advisories from the last 90 days; KEV mappings come from MITRE CTID. Coverage is the SigmaHQ rule inventory (core, emerging-threats, threat-hunting) at release r2026-07-01 plus Elastic and Splunk production rules. Rule bodies are not mirrored; links go upstream.