Adversaries may attempt to get a listing of open application windows. Window listings could convey information about how the system is used.1 For example, information about application windows could be used to identify potential data to collect as well as identifying security tooling (Security Software Discovery) to evade.2 Adversaries typically abuse system features for this type of enumeration. For example, they may gather information through native system features such as Command and Scripting Interpreter commands and Native API functions.
- Prevailion DarkWatchman 2021
- ESET Grandoreiro April 2020
Groups using this technique
| Group | Name | Country |
|---|---|---|
| grp_g0032 | Lazarus Group | DPRK |
| grp_g1001 | HEXANE | — |
| grp_g1017 | Volt Typhoon | — |
Claims
No public claim points at this technique yet.
Auto-ingested and not human-reviewed; confidence and validity read by citation.