T1010

Official Description

Adversaries may attempt to get a listing of open application windows. Window listings could convey information about how the system is used.(Citation: Prevailion DarkWatchman 2021) For example, information about application windows could be used identify potential data to collect as well as identifying security tooling ([Security Software Discovery](https://attack.mitre.org/techniques/T1518/001)) to evade.(Citation: ESET Grandoreiro April 2020)

Adversaries typically abuse system features for this type of enumeration. For example, they may gather information through native system features such as [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059) commands and [Native API](https://attack.mitre.org/techniques/T1106) functions.

Tactics: Discovery
Platforms: Linux, macOS, Windows
MITRE Version: 1.3
Last Modified: May 12, 2026

View on MITRE ATT&CK ↗

Reported Context (2)

The implant collects the window title of the topmost active program. QuickFox Supply-Chain Attack Deployed FDMTP Implant on Windows Systems
NarwhalRAT gathered active and running window titles, associated process information, and window state through Windows APIs. Genians Details NarwhalRAT Campaign Using Microsoft-Themed Phishing and Dead-Drop C2

Malware (3)

People (1)

Threat Actors (2)

MITRE ATT&CK (39)

Vendors (4)

Products (15)

Tools (6)

Countries (2)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.