T1010 Application Window Discovery: Detection, Mitigation and Response for Defenders

Malware that reads the titles of open windows learns what the user is doing right now: which bank, which admin console, which password vault or which security tool is on screen, and uses that to decide when to log keystrokes, take screenshots or hide. MITRE ATT&CK tracks this as T1010 Application Window Discovery, a Discovery technique on Windows, Linux and macOS. It is quiet, needs no privilege and is built into almost every keylogger, remote access trojan and infostealer family, which makes it a weak signal on its own but a valuable one in context. This guide is for detection engineers, SOC analysts and endpoint teams. It explains how the technique works at the level needed to detect it, what ATT&CK v20 recommends watching, real procedure examples, and the controls that limit what window titles give away.

Key takeaways

• Window titles are context for theft. Keyloggers and RATs pair window titles with captured keystrokes, and some only start logging when a title matches a target such as a bank name.
• The API path leaves little process evidence. Native calls such as EnumWindows and GetWindowText run inside the implant, so detection depends on EDR API telemetry, script logging and behaviour around the call.
• No ATT&CK mitigation exists. ATT&CK v20 lists none for T1010; the practical defences are stopping the malware from running and limiting what titles reveal.
• Script-based enumeration is the best catch. PowerShell, VBScript or AppleScript that lists windows is rare in normal use and is logged by script block logging and the macOS unified log.
• Treat a hit as a credential event. Window discovery inside a keylogger or stealer means credentials and sessions typed or shown on that host should be treated as exposed.

What T1010 covers in ATT&CK v20

ATT&CK v20 (technique version 1.3) describes Application Window Discovery as getting a listing of open application windows, which can show how a system is used, identify data worth collecting and reveal security tooling to evade. Adversaries typically use native system features, through Command and Scripting Interpreter (T1059) commands or Native API (T1106) functions. There are no sub-techniques and no listed mitigations.

How it works, at detection depth

• Windows: Microsoft documents that EnumWindows enumerates all top-level windows on the screen (on Windows 8 and later, top-level windows of desktop apps) and passes each handle to a callback. GetWindowText then returns the caption of a window, including one owned by another process. GetForegroundWindow returns the window the user is working in. None of this needs administrator rights, but it runs within the user's interactive session and desktop.
• Linux: the v20 analytic names X11 utilities such as xdotool and wmctrl and scripted equivalents that list windows and active desktops.
• macOS: the v20 analytic names AppleScript, the CGWindowListCopyWindowInfo API and NSRunningApplication to list windows and foreground applications.

The technique is related to, but distinct from, Process Discovery (T1057), Screen Capture (T1113), Keylogging (T1056.001) and Security Software Discovery (T1518.001). In practice it is the glue between them: titles decide which window gets screenshotted and which keystrokes get labelled.

Keyloggers, stealers and window titles

The ATT&CK v20 data has 37 procedure examples for T1010. Most are malware families, and they show four patterns.

A government-documented case

CISA advisory AA24-038A on Volt Typhoon reports that a log file on a domain controller captured window title information, focus shifts and keypresses across Chrome and PowerShell. ATT&CK v20 records this as Volt Typhoon collecting window title information from compromised systems. The lesson is that window discovery is not only a commodity malware trait: a state-sponsored group used it on a tier 0 server, where the windows on screen belonged to administrators.

What to detect and where

ATT&CK v20 detection strategy DET0097, "Detection of Application Window Enumeration via API or Scripting", has one analytic per platform. The data components below come from the v20 data; the notes are ours.

Detection logic that holds up

• Script enumeration of windows: PowerShell script blocks that call user32 window functions through Add-Type or reflection, or read MainWindowTitle for all processes in a loop, from a user who is not a developer. High fidelity once developer and IT automation hosts are excluded.
• Window enumeration plus input hooks: EDR events showing a process both enumerating windows and installing a keyboard hook (SetWindowsHookEx with a low-level keyboard hook) or polling key state. This is the keylogger signature; see the MITRE ATT&CK T1056 Input Capture guide.
• Window enumeration plus screen capture: a process that reads titles and then calls screen capture APIs or writes image files to temporary folders.
• Unusual process making the calls: window enumeration by processes running from user-writable paths (AppData, Temp, Downloads, Public), unsigned binaries or newly seen hashes.
• Window tools on servers: xdotool, wmctrl or AppleScript window queries on systems that have no reason to run a GUI session, and any window title logging on domain controllers, which the Volt Typhoon case shows.

Expected noise

Legitimate software enumerates windows constantly: accessibility tools, screen readers, remote support and screen sharing clients, window managers, productivity and time tracking agents, data loss prevention and some EDR products. Build allow lists by signer and install path, and review them, because remote support tools are also abused (see Detecting RustDesk, MeshCentral and Tactical RMM Abuse). Sysmon event 10 in particular is noisy; Microsoft's Sysmon documentation advises enabling process access logging only with filters that remove expected accesses. See the Sysmon Guide.

Mitigation and exposure reduction

ATT&CK v20 maps no mitigation to T1010. Window enumeration is a normal operating system feature that cannot be turned off for some processes and left on for others without breaking accessibility and support tooling. The controls below are NHI Mgmt Group recommendations that stop the malware or reduce the value of what it reads.

Where identity fits

The point of window discovery for most malware is credential and session theft. A title such as an admin portal, a cloud console, a password manager or a remote desktop session to a named server tells the operator which captured keystrokes are a privileged password, which cookie is worth replaying and which host to target next. When T1010 is found inside a keylogger or stealer, respond as the Infostealer Threat Guide describes: revoke sessions and rotate every human and non-human credential used on that host, including API keys and tokens pasted into terminals or consoles while the malware was active. See also Infostealer Logs and Session Token Abuse Guide.

Response when window discovery is confirmed

1. Classify the tool. Decide whether the enumerating process is a known legitimate agent, a remote support tool used outside policy, or malware. Check signer, path, parent and first-seen date.
2. Look for the companions. Search the same process for keyboard hooks, screen capture, clipboard access (T1115) and outbound connections. Their presence turns a discovery alert into a collection incident.
3. Isolate before analysis tools. Malware such as Grandoreiro reacts to analysis tool windows, so contain the host through the EDR first and collect memory and disk evidence before opening tools on the live session.
4. Scope the exposure window. Use sign-in logs to list every account that authenticated from the host since the malware's first execution.
5. Revoke and rotate. Revoke sessions, reset passwords, and rotate secrets for those accounts, prioritising privileged and service credentials.
6. Rebuild and fix the entry point. Reimage the host and close the delivery route (attachment, malvertising, cracked software).

How to test your coverage

1. Check telemetry. Confirm PowerShell 4104, EDR API events and macOS unified log collection on a pilot ring.
2. Emulate safely. In an authorised test, use an open emulation library's T1010 tests or a purple team script that lists window titles via PowerShell, then via a compiled test binary. Record which produce telemetry and which raise an alert.
3. Emulate the combination. Run window enumeration with a benign screen capture in the same process to test the correlation rule.
4. Tune in alert-only mode for two weeks; allow list by signer and path.
5. Rollback: keep rules in a dedicated group that can be disabled independently.

Metrics

• Script logging coverage: percentage of Windows endpoints sending PowerShell 4104 events.
• Route coverage: of the script and compiled API test routes, how many produce an alert.
• Combination detections: alerts where window enumeration co-occurs with input capture or screen capture, and their true positive rate.
• Revocation time: median time from a confirmed keylogger or stealer to session revocation for all accounts used on the host.
• Application control enforcement: percentage of endpoints blocking execution from user-writable paths.

Common failure patterns

• Expecting a process event. Rules written for a command line never fire because compiled malware calls the API directly.
• Closing the alert as "discovery only". Window enumeration in an unknown binary is usually part of a keylogger or RAT; triage the whole process.
• Cleaning without revoking. The host is reimaged but passwords and sessions captured with window context stay valid.
• Blanket allow lists for support tools. Remote access tools are exempted by name, including copies an attacker installed.
• Ignoring servers. Window title logging on a domain controller, as in the Volt Typhoon case, is missed because servers are assumed to have no interactive users.

Framework mapping

Practitioner checklist

• Enable PowerShell script block logging and collect it centrally.
• Confirm the EDR records API-level window enumeration, keyboard hooks and screen capture, and that rules can correlate them per process.
• Collect auditd EXECVE on Linux and the unified log on macOS; alert on window tools on servers.
• Allow list legitimate enumerators by signer and path; review remote support tools separately.
• Enforce application control on user-writable paths and Constrained Language Mode for PowerShell.
• Manage macOS Screen Recording and Accessibility approvals through MDM.
• Write the response step "revoke sessions and rotate credentials used on this host" into the keylogger and stealer playbook.
• Keep admin consoles on privileged access workstations.

Standards and references

• MITRE ATT&CK: T1010 Application Window Discovery
• CISA: AA24-038A PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure
• Microsoft Learn: EnumWindows function
• Microsoft Learn: GetWindowTextW function
• Microsoft Learn: Sysmon
• Kaspersky Securelist: BlindEagle APT research
• ESET WeLiveSecurity: Grandoreiro, how engorged can an EXE get?

Related NHI Mgmt Group resources: Keyloggers Guide · Infostealer Logs Monitoring and Response Guide · ATT&CK Collection Tactic Guide · EDR Guide