应用窗口发现

Sub-techniques (4)

ID	Name
T1010.001	API混淆调用窗口枚举
T1010.002	进程注入式窗口嗅探
T1010.003	GUI自动化伪装窗口遍历
T1010.004	间接窗口信息嗅探链

应用窗口发现是攻击者通过枚举系统打开的应用程序窗口来识别用户活动状态和安全防护态势的侦察技术。攻击者通常利用系统内置命令（如PowerShell的Get-Process）、原生API调用（如EnumWindows）或GUI自动化工具获取窗口标题、类名等信息，用于后续攻击链的情报支撑。防御方可通过监控敏感API调用序列、检测非常规进程的窗口操作行为，以及分析用户交互模式异常来识别潜在攻击。

为规避传统窗口发现技术存在的API调用特征明显、进程行为异常易检测等缺陷，攻击者发展出多维度匿迹方法，通过代码注入、人机行为仿真、系统内部结构解析等手法，将窗口侦察行为深度嵌入系统合法工作流程，形成"无痕化"信息收集能力。

当前应用窗口发现匿迹技术的核心创新体现在侦察路径的间接化与行为上下文的合法化重构。攻击者突破直接API调用模式，构建多层间接信息获取体系：API混淆调用通过动态加载和参数加密实现调用特征模糊化；进程注入技术将恶意代码寄生在可信进程内，利用系统白名单机制规避检测；GUI自动化伪装通过精确模拟人类操作节奏破坏自动化行为识别模型；间接嗅探链则绕过高层API监控，直接从系统底层数据结构提取窗口信息。这些技术的共性在于突破传统行为监控的观测维度，通过系统机制滥用、合法工具劫持和人因特征融合，将恶意窗口发现行为转化为具备表面合法性的系统正常操作，显著提升攻击行为的隐蔽性和持续性。

匿迹技术的演进导致传统基于API钩子、进程行为分析的检测方法面临失效风险，防御方需加强内存行为监控、人机交互特征识别等能力，构建跨进程事件关联分析体系，并引入AI模型检测非常规系统资源访问模式，实现对隐蔽窗口发现行为的深度防御。

ID: T1010

Sub-techniques: T1010.001, T1010.002, T1010.003, T1010.004

ⓘ

Tactic: 环境测绘

ⓘ

Platforms: Linux, Windows, macOS

Version: 1.3

Created: 31 May 2017

Last Modified: 15 October 2024

匿迹效应

效应类型	是否存在
特征伪装	✅
行为透明	✅
数据遮蔽	✅
时空释痕	✅

特征伪装

攻击者通过劫持合法进程的GUI操作上下文，将窗口发现行为伪装成正常用户交互或系统管理操作。例如利用签名自动化工具执行窗口遍历，或模仿Alt+Tab切换的时序特征，使得窗口枚举行为在交互模式和数字签名层面均呈现合法属性。

行为透明

采用零日漏洞利用或未公开的系统内部机制（如GDI对象解析）进行窗口信息提取，规避基于已知API调用序列的检测规则。通过直接操作内核数据结构或硬件层资源，实现绕过用户态监控的"无痕"侦察。

数据遮蔽

在进程注入式嗅探中，攻击者使用共享内存和加密通道传输窗口信息，避免敏感数据在磁盘或网络流量中明文出现。内存驻留型恶意代码确保侦察数据仅在运行时存在，不产生持久化存储痕迹。

时空释痕

通过低频次、事件触发的窗口发现策略，将侦察行为分散在长时间周期内。例如仅在用户登录后或特定应用程序启动时执行局部窗口枚举，使侦察活动特征稀释在正常的系统生命周期事件流中。

Procedure Examples

ID	Name	Description
S0456	Aria-body	Aria-body has the ability to identify the titles of running windows on a compromised host.^[1]
S0438	Attor	Attor can obtain application window titles and then determines which windows to perform Screen Capture on.^[2]
S0454	Cadelspy	Cadelspy has the ability to identify open windows on the compromised host.^[3]
S0261	Catchamas	Catchamas obtains application windows titles and then determines which windows to perform Screen Capture on.^[4]
S1111	DarkGate	DarkGate will search for cryptocurrency wallets by examining application window names for specific strings.^[5] DarkGate extracts information collected via NirSoft tools from the hosting process's memory by first identifying the window through the `FindWindow` API function.^[5]
S0673	DarkWatchman	DarkWatchman reports window names along with keylogger information to provide application context.^[6]
S0038	Duqu	The discovery modules used with Duqu can collect information on open windows.^[7]
S1159	DUSTTRAP	DUSTTRAP can enumerate running application windows.^[8]
S0696	Flagpro	Flagpro can check the name of the window displayed on the system.^[9]
S1044	FunnyDream	FunnyDream has the ability to discover application windows via execution of `EnumWindows`.^[10]
S0531	Grandoreiro	Grandoreiro can identify installed security tools based on window names.^[11]
G1001	HEXANE	HEXANE has used a PowerShell-based keylogging tool to capture the window title.^[12]
S0431	HotCroissant	HotCroissant has the ability to list the names of all open windows on the infected host.^[13]
S0260	InvisiMole	InvisiMole can enumerate windows and child windows on a compromised host.^[14]^[15]
S0265	Kazuar	Kazuar gathers information about opened windows.^[16]
G0032	Lazarus Group	Lazarus Group malware IndiaIndia obtains and sends to its C2 server the title of the window for each running process. The KilaAlfa keylogger also reports the title of the window in the foreground.^[17]^[18]^[19]
S0409	Machete	Machete saves the window names.^[20]
S0455	Metamorfo	Metamorfo can enumerate all windows on the victim’s machine.^[21]^[22]
S0033	NetTraveler	NetTraveler reports window names along with keylogger information to provide application context.^[23]
S0198	NETWIRE	NETWIRE can discover and close windows on controlled systems.^[24]
S1090	NightClub	NightClub can use `GetForegroundWindow` to enumerate the active window.^[25]
S0385	njRAT	njRAT gathers information about opened windows during the initial infection.^[26]
S0435	PLEAD	PLEAD has the ability to list open windows on the compromised host.^[27]^[27]
S0012	PoisonIvy	PoisonIvy captures window titles.^[28]
S0139	PowerDuke	PowerDuke has a command to get text of the current foreground window.^[29]
S0650	QakBot	QakBot has the ability to enumerate windows on a compromised host.^[30]
S0375	Remexi	Remexi has a command to capture active windows on the machine and retrieve window titles.^[31]
S0240	ROKRAT	ROKRAT can use the `GetForegroundWindow` and `GetWindowText` APIs to discover where the user is typing.^[32]
S0692	SILENTTRINITY	SILENTTRINITY can enumerate the active Window during keylogging through execution of `GetActiveWindowTitle`.^[33]
S0157	SOUNDBITE	SOUNDBITE is capable of enumerating application windows.^[34]
S0094	Trojan.Karagany	Trojan.Karagany can monitor the titles of open windows to identify specific keywords.^[35]
G1017	Volt Typhoon	Volt Typhoon has collected window title information from compromised systems.^[36]
S0219	WINERACK	WINERACK can enumerate active windows.^[37]

Mitigations

This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features.

Detection

ID Data Source Data Component Detects

ID	Data Source	Data Component	Detects
DS0017	Command	Command Execution	Monitor executed commands and arguments for actions that could be taken to gather system and network information. Information may also be acquired through Windows system management tools such as Windows Management Instrumentation and PowerShell. Note: Commands can also be obtained from Payload event field for PowerShell event id 4103. For PowerShell Module logging event id 4103, enable logging for module Microsoft.PowerShell.Management. Analytic 1 - Suspicious Commands `sourcetype="WinEventLog:Microsoft-Windows-PowerShell/Operational" EventCode="4103" \| where CommandLine LIKE "%Get-Process%" AND CommandLine LIKE "%mainWindowTitle%"`
DS0009	Process	OS API Execution	Monitor for API calls (such as `GetForegroundWindow()`) that may attempt to get a listing of open application windows. `GetForegroundWindow` api returns a handle to the foreground window (the window with which the user is currently working). Other API calls relevant to Local Group discovery include `GetProcesses` and `GetForegroundWindow`. `GetProcesses` api returns an array of type Process that represents all the process resources running on the local computer. Note: Most EDR tools do not support direct monitoring of API calls due to the sheer volume of calls produced by an endpoint but may have alerts or events that are based on abstractions of OS API calls. Dynamic malware analysis tools (i.e., sandboxes) can be used to trace the execution, including OS API calls, for a single PE binary.
		Process Creation	Monitor for newly executed processes that may attempt to get a listing of open application windows. System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities based on the information obtained. Note: Event IDs are for Sysmon (Event ID 1 - process create) and Windows Security Log (Event ID 4688 - a new process has been created). Analytic 1 - Suspicious Processes `(sourcetype="WinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode="1") OR (sourcetype="WinEventLog:Security" EventCode="4688") \| where CommandLine LIKE "%Get-Process%" AND CommandLine LIKE "%mainWindowTitle%"`

DS0017

Command

Command Execution

Monitor executed commands and arguments for actions that could be taken to gather system and network information. Information may also be acquired through Windows system management tools such as Windows Management Instrumentation and PowerShell.

Note: Commands can also be obtained from Payload event field for PowerShell event id 4103. For PowerShell Module logging event id 4103, enable logging for module Microsoft.PowerShell.Management.

Analytic 1 - Suspicious Commands

sourcetype="WinEventLog:Microsoft-Windows-PowerShell/Operational" EventCode="4103" | where CommandLine LIKE "%Get-Process%" AND CommandLine LIKE "%mainWindowTitle%"

DS0009

Process

OS API Execution

Monitor for API calls (such as GetForegroundWindow()) that may attempt to get a listing of open application windows. GetForegroundWindow api returns a handle to the foreground window (the window with which the user is currently working). Other API calls relevant to Local Group discovery include GetProcesses and GetForegroundWindow. GetProcesses api returns an array of type Process that represents all the process resources running on the local computer.

Note: Most EDR tools do not support direct monitoring of API calls due to the sheer volume of calls produced by an endpoint but may have alerts or events that are based on abstractions of OS API calls. Dynamic malware analysis tools (i.e., sandboxes) can be used to trace the execution, including OS API calls, for a single PE binary.

Process Creation

Monitor for newly executed processes that may attempt to get a listing of open application windows. System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities based on the information obtained.

Note: Event IDs are for Sysmon (Event ID 1 - process create) and Windows Security Log (Event ID 4688 - a new process has been created).

Analytic 1 - Suspicious Processes

(sourcetype="WinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode="1") OR (sourcetype="WinEventLog:Security" EventCode="4688") | where CommandLine LIKE "%Get-Process%" AND CommandLine LIKE "%mainWindowTitle%"