Detect Application Window Discovery in Splunk
Adversaries may attempt to get a listing of open application windows. Window listings convey information about how the system is used and help adversaries identify potential data sources and security tooling to evade. Malware families including Attor, njRAT, DarkWatchman, Grandoreiro, InvisiMole, and Lazarus Group tooling use this technique to obtain window titles and correlate them with keylogger output, identify running security products by window name, locate cryptocurrency wallets, and determine sandbox environments. Adversaries typically implement this via native Windows API functions (EnumWindows, GetForegroundWindow, FindWindow, GetWindowText from user32.dll), scripting languages using P/Invoke or COM automation, or automation tools such as AutoHotkey and AutoIt. On Linux and macOS, adversaries may use xdotool, wmctrl, or Quartz/Cocoa APIs to achieve equivalent capability.
MITRE ATT&CK
- Tactic
- Discovery
- Technique
- T1010 Application Window Discovery
- Canonical reference
- https://attack.mitre.org/techniques/T1010/
SPL Detection Query
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
| eval CommandLineLower=lower(CommandLine)
| eval ImageLower=lower(Image)
| eval ParentImageLower=lower(ParentImage)
| eval ScriptWindowAPIEnum=if(
match(ImageLower, "(powershell|pwsh|wscript|cscript|mshta|python[23]?|ruby|perl)\.exe") AND
match(CommandLineLower, "(getforegroundwindow|enumwindows|findwindow|getwindowtext|getactivewindow|enumchildwindows|getwindowlong|findwindowex)"),
1, 0)
| eval PInvokePattern=if(
match(ImageLower, "(powershell|pwsh)\.exe") AND
match(CommandLineLower, "(add-type|dllimport)") AND
match(CommandLineLower, "user32") AND
match(CommandLineLower, "(window|hwnd)"),
1, 0)
| eval COMShellEnum=if(
match(ImageLower, "(powershell|pwsh|wscript|cscript|mshta)\.exe") AND
match(CommandLineLower, "shell\.application") AND
match(CommandLineLower, "windows\(\)"),
1, 0)
| eval AutomationToolEnum=if(
match(ImageLower, "(autoit3|autohotkey|ahk2exe)(_x64)?\.exe") AND
NOT match(ParentImageLower, "(explorer|devenv|code|notepad\+\+|sublime_text|atom)\.exe"),
1, 0)
| eval KnownWinEnumTool=if(
match(ImageLower, "(winlister|wintitles|windowdetective|spyxx(_amd64)?|winspector)\.exe"),
1, 0)
| eval TotalScore=ScriptWindowAPIEnum + PInvokePattern + COMShellEnum + AutomationToolEnum + KnownWinEnumTool
| where TotalScore > 0
| eval DetectionVector=case(
KnownWinEnumTool=1, "Known Window Enumeration Utility",
AutomationToolEnum=1, "Automation Tool Window Enumeration (Unusual Parent)",
PInvokePattern=1, "PowerShell P/Invoke Window API",
COMShellEnum=1, "COM Shell Window Enumeration",
ScriptWindowAPIEnum=1, "Script Window Enumeration API",
1=1, "Unknown"
)
| table _time, host, User, Image, CommandLine, ParentImage, ParentCommandLine, DetectionVector, TotalScore
| sort - _timeDetects application window discovery via Sysmon Event ID 1 (Process Creation). Evaluates command lines from scripting engines and automation tools against known window enumeration patterns including Win32 API function names (EnumWindows, GetForegroundWindow, GetWindowText), PowerShell P/Invoke signatures loading user32.dll for window operations, COM Shell.Application window enumeration, and AutoHotkey/AutoIt spawned from non-development parent processes. A composite score is computed to prioritize alerts with multiple corroborating indicators.
Data Sources
Required Sourcetypes
False Positives & Tuning
- Legitimate AutoHotkey or AutoIt scripts used by IT support staff for desktop automation and helpdesk tooling
- Screen recording, remote desktop, and accessibility software (NVDA, JAWS, TeamViewer) that enumerates windows for UI interaction
- Developer tooling such as UI testing frameworks (WinAppDriver, TestComplete, Ranorex) that programmatically enumerate windows
- Python RPA automation using pywin32 or pywinauto libraries in approved business automation workflows
- PowerShell scripts querying Shell.Application window state for IT inventory or configuration management
Other platforms for T1010
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1PowerShell P/Invoke Window Enumeration via GetForegroundWindow
Expected signal: Sysmon Event ID 1: Process Create with Image=powershell.exe, CommandLine containing 'Add-Type', 'DllImport', 'user32.dll', 'GetForegroundWindow', and 'GetWindowText'. PowerShell ScriptBlock Log Event ID 4104 in Microsoft-Windows-PowerShell/Operational will capture the full deobfuscated Add-Type code block including the user32.dll import declarations.
- Test 2PowerShell COM Shell.Application Window Enumeration
Expected signal: Sysmon Event ID 1: Process Create with Image=powershell.exe, CommandLine containing 'Shell.Application' and 'Windows()'. PowerShell ScriptBlock Log Event ID 4104 with the full COM enumeration code. No network connection events expected as this is a local enumeration call.
- Test 3PowerShell Full Window Enumeration via EnumWindows Callback
Expected signal: Sysmon Event ID 1: Process Create with Image=powershell.exe, CommandLine containing 'Add-Type', 'EnumWindows', 'GetWindowText', 'IsWindowVisible', and 'user32.dll'. PowerShell ScriptBlock Log Event ID 4104 with the full multi-line Add-Type type definition including all three DllImport declarations and the callback delegate pattern.
- Test 4VBScript COM Window Enumeration via Shell.Application
Expected signal: File creation event (Sysmon Event ID 11) for %TEMP%\df00tech_wintenum.vbs. Sysmon Event ID 1: Process Create with Image=cscript.exe, CommandLine containing '//e:vbscript' and the .vbs filename. The VBScript content (Shell.Application COM enumeration) will be visible in script file artifacts but not the cscript command line itself — emphasizing the need for script content logging where available.
References (10)
- https://attack.mitre.org/techniques/T1010/
- https://web.archive.org/web/20220629230035/https://www.prevailion.com/darkwatchman-new-fileless-techniques/
- https://www.welivesecurity.com/2020/04/28/grandoreiro-how-engorged-can-exe-get/
- https://www.welivesecurity.com/2019/10/10/eset-discovers-attor-a-spy-platform-with-curious-GSM-fingerprinting/
- https://securelist.com/nettraveler-is-running-red-star-apt-attacks-compromise-high-profile-victims/35936/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1010/T1010.md
- https://learn.microsoft.com/en-us/windows/win32/api/winuser/nf-winuser-enumwindows
- https://learn.microsoft.com/en-us/windows/win32/api/winuser/nf-winuser-getforegroundwindow
- https://learn.microsoft.com/en-us/defender-endpoint/advanced-hunting-deviceprocessevents-table
- https://www.autohotkey.com/docs/v2/lib/WinGetTitle.htm
Unlock Pro Content
Get the full detection package for T1010 including response playbook, investigation guide, and atomic red team tests.