Details
-
Type:
Task
-
Status: To Do
-
Priority:
Medium
-
Resolution: Unresolved
-
Labels:None
-
datasources:Process command-line parameters, Process monitoring, API monitoring
-
id:T1010
-
tactic:discovery
-
maturity:Not Tracked
Description
Adversaries may attempt to get a listing of open application windows. Window listings could convey information about how the system is used or give context to information collected by a keylogger.
In Mac, this can be done natively with a small [AppleScript](https://attack.mitre.org/techniques/T1155) script.
