AN0271
Analytic 0271
Windows
Processes using Win32 API calls (e.g., EnumWindows, GetForegroundWindow) or scripting tools (e.g., PowerShell, VBScript) to enumerate open windows. These often appear with reconnaissance or data collection TTPs.
WinEventLog:Sysmon
EventCode=10
WinEventLog:PowerShell
EventCode=4103, 4104, 4105, 4106
[AccessedFunction]
Tune to focus on suspicious function calls (e.g., user32.dll!EnumWindows).
[UserContext]
Detect behavior from non-interactive or low-privileged users where enumeration is uncommon.
[TimeWindow]
Shorten detection scope to rapid successive window enumeration attempts.
AN0272
Analytic 0272
Linux
Scripted or binary usage of X11 utilities (e.g., xdotool, wmctrl) or direct /proc/*/window mappings to discover open GUI windows and active desktops.
auditd:EXECVE
execve
linus:syslog
None
[ExecutableName]
Common window management utilities can be tuned to reduce noise (e.g., xprop, xwininfo).
[DisplayContext]
Restrict detection to processes executing under graphical sessions (e.g., DISPLAY=:0).
AN0273
Analytic 0273
macOS
Processes that utilize AppleScript, `CGWindowListCopyWindowInfo`, or `NSRunningApplication` APIs to list active application windows and foreground processes.
macos:unifiedlog
None
macos:osquery
process_events
[AppleScriptTarget]
Tunable to ignore benign scripting like automation by known apps.
[ParentProcess]
Useful to suppress expected automation processes.