Adversaries may attempt to get a listing of open application windows. Window listings could convey information about how the system is used.(Citation: Prevailion DarkWatchman 2021) For example, information about application windows could be used identify potential data to collect as well as identifying security tooling ([Security Software Discovery](https://attack.mitre.org/techniques/T1518/001)) to evade.(Citation: ESET Grandoreiro April 2020)

Adversaries typically abuse system features for this type of enumeration. For example, they may gather information through native system features such as [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059) commands and [Native API](https://attack.mitre.org/techniques/T1106) functions.
Application Window Discovery
source_name: mitre-attack  url: https://attack.mitre.org/techniques/T1010  external_id: T1010     source_name: ESET Grandoreiro April 2020  description: ESET. (2020, April 28). Grandoreiro: How engorged can an EXE get?. Retrieved November 13, 2020.  url: https://www.welivesecurity.com/2020/04/28/grandoreiro-how-engorged-can-exe-get/     source_name: Prevailion DarkWatchman 2021  description: Smith, S., Stafford, M. (2021, December 14). DarkWatchman: A new evolution in fileless techniques. Retrieved January 10, 2022.  url: https://www.prevailion.com/darkwatchman-new-fileless-techniques/     