Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in User Guide
Log in Get started
Detection Strategies DET0097 — Detection of Application Window Enumeration via API or Scripting
DET0097

Detection of Application Window Enumeration via API or Scripting

3 analytic(s) · 1 technique(s) detected

Analytics

3
AN0271 Analytic 0271
Windows

Processes using Win32 API calls (e.g., EnumWindows, GetForegroundWindow) or scripting tools (e.g., PowerShell, VBScript) to enumerate open windows. These often appear with reconnaissance or data collection TTPs.

WinEventLog:Sysmon EventCode=10 WinEventLog:PowerShell EventCode=4103, 4104, 4105, 4106
[AccessedFunction] Tune to focus on suspicious function calls (e.g., user32.dll!EnumWindows).
[UserContext] Detect behavior from non-interactive or low-privileged users where enumeration is uncommon.
[TimeWindow] Shorten detection scope to rapid successive window enumeration attempts.
AN0272 Analytic 0272
Linux

Scripted or binary usage of X11 utilities (e.g., xdotool, wmctrl) or direct /proc/*/window mappings to discover open GUI windows and active desktops.

auditd:EXECVE execve linus:syslog None
[ExecutableName] Common window management utilities can be tuned to reduce noise (e.g., xprop, xwininfo).
[DisplayContext] Restrict detection to processes executing under graphical sessions (e.g., DISPLAY=:0).
AN0273 Analytic 0273
macOS

Processes that utilize AppleScript, `CGWindowListCopyWindowInfo`, or `NSRunningApplication` APIs to list active application windows and foreground processes.

macos:unifiedlog None macos:osquery process_events
[AppleScriptTarget] Tunable to ignore benign scripting like automation by known apps.
[ParentProcess] Useful to suppress expected automation processes.

Detected Techniques

1

Details

MITRE ID
DET0097
STIX ID
x-mitre-detection-strategy--d2daf569-4fc9-46a3-97b7-4d3d76c04a64
Analytics
3
Techniques Detected
1
By Tactic
Discovery
1
Leaving Threaticon

This link opens an external site that isn't part of the platform.