Skip to content

Application Window Discovery

Technique · ATTACK:enterprise:T1010

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1010",
  "title": "Application Window Discovery",
  "type": "Technique",
  "source_url": "https://attack.mitre.org/techniques/T1010",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--4ae4f953-fe58-4cc8-a327-33257e30a830",
  "external_id": "T1010",
  "domain": "enterprise",
  "created": "2017-05-31T21:30:24.512Z",
  "modified": "2026-05-12T15:12:00.630Z",
  "version": "1.3",
  "aliases": [

  ],
  "tactics": [
    "discovery"
  ],
  "source_references": [
    {
      "source_name": "ESET Grandoreiro April 2020",
      "url": "https://www.welivesecurity.com/2020/04/28/grandoreiro-how-engorged-can-exe-get/"
    },
    {
      "source_name": "Prevailion DarkWatchman 2021",
      "url": "https://web.archive.org/web/20220629230035/https://www.prevailion.com/darkwatchman-new-fileless-techniques/"
    }
  ]
}

Explicit source assertions (37)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S0438 → uses → ATTACK:enterprise:T1010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0dfdfffc-2d1b-487f-91e0-66d81b185367

ESET Attor Oct 2019

ATTACK:enterprise:S0033 → uses → ATTACK:enterprise:T1010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--10c6cc56-a028-4c2a-b24e-38d97fb4ebb7

Kaspersky NetTraveler

ATTACK:enterprise:S0454 → uses → ATTACK:enterprise:T1010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--13e89239-af0e-4f3c-9bb9-42b113f64873

Symantec Chafer Dec 2015

ATTACK:enterprise:S0696 → uses → ATTACK:enterprise:T1010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--149d6bae-0322-40b2-a361-e0d94db0601e

NTT Security Flagpro new December 2021

ATTACK:enterprise:S0385 → uses → ATTACK:enterprise:T1010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--14a2bfd9-8be1-47f9-bced-b05ba2179eb5

Fidelis njRAT June 2013

ATTACK:enterprise:G0032 → uses → ATTACK:enterprise:T1010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--170e2f76-5b6a-4eee-8ea4-d1171368b4a9

Novetta Blockbuster Loaders · Novetta Blockbuster Tools · Novetta Blockbuster

ATTACK:enterprise:S0094 → uses → ATTACK:enterprise:T1010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--25bfb4d8-c401-4064-9ee4-24091cb86ba6

Secureworks Karagany July 2019

ATTACK:enterprise:S1111 → uses → ATTACK:enterprise:T1010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--36a93ca6-ad3b-468a-b5a3-d4676410ae1b

Ensilo Darkgate 2018

ATTACK:enterprise:S0673 → uses → ATTACK:enterprise:T1010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--42c6147c-8626-4ea1-bc69-7b35ea69e2ed

Prevailion DarkWatchman 2021

ATTACK:enterprise:S0139 → uses → ATTACK:enterprise:T1010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--43d85ed6-223e-4402-bd29-be10a872359d

Volexity PowerDuke November 2016

ATTACK:enterprise:S0260 → uses → ATTACK:enterprise:T1010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--47ba2c60-f295-4a91-bcd1-ac17292f4e7e

ESET InvisiMole June 2018 · ESET InvisiMole June 2020

ATTACK:enterprise:S0456 → uses → ATTACK:enterprise:T1010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5ab058a1-4c88-481f-a7a8-77855ee916e6

CheckPoint Naikon May 2020

ATTACK:enterprise:S0531 → uses → ATTACK:enterprise:T1010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5adc78d2-a013-4a4e-afda-9a7dd38fb5fa

ESET Grandoreiro April 2020

ATTACK:enterprise:S1239 → uses → ATTACK:enterprise:T1010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--607a87a7-ecdd-4548-bca8-a8486e061395

2022 November_TrendMicro_Earth Preta_Toneshell_Pubload

ATTACK:enterprise:S0219 → uses → ATTACK:enterprise:T1010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--69f45e5e-2ebe-4cce-a4cd-e1db67bdff1a

FireEye APT37 Feb 2018

ATTACK:enterprise:S0409 → uses → ATTACK:enterprise:T1010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8ab5954b-d36f-40c3-8f90-7e4862d38f43

ESET Machete July 2019

ATTACK:enterprise:S1090 → uses → ATTACK:enterprise:T1010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--911beb36-2a36-4c26-9e0d-bea35f6497b6

MoustachedBouncer ESET August 2023

ATTACK:enterprise:S0198 → uses → ATTACK:enterprise:T1010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ac0b0f1f-a9c8-4890-aa2f-6012b75a9c52

Red Canary NETWIRE January 2020

ATTACK:enterprise:S0265 → uses → ATTACK:enterprise:T1010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--afa84fd1-e910-4bc7-8270-1e9f9b02b53f

Unit 42 Kazuar May 2017

ATTACK:enterprise:S0375 → uses → ATTACK:enterprise:T1010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b2cf2404-a612-4832-8dff-9f5572776785

Securelist Remexi Jan 2019

ATTACK:enterprise:S1159 → uses → ATTACK:enterprise:T1010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b62a2a23-884c-431d-9f08-911d9ba66d48

Google Cloud APT41 2024

ATTACK:enterprise:S0157 → uses → ATTACK:enterprise:T1010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b640dfee-9502-4ffb-92e4-f153f8726383

FireEye APT32 May 2017

ATTACK:enterprise:S0038 → uses → ATTACK:enterprise:T1010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bbc31a33-f55f-43d4-a3fd-23426c5fc638

Symantec W32.Duqu

ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:T1010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bc681eea-c32c-4cc1-80a6-efd759da8bb9

CISA AA24-038A PRC Critical Infrastructure February 2024

ATTACK:enterprise:S0431 → uses → ATTACK:enterprise:T1010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c8a01e1c-dac0-4a47-bda3-3b5684bd3d47

Carbon Black HotCroissant April 2020

ATTACK:enterprise:S1233 → uses → ATTACK:enterprise:T1010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ca882933-d3ee-4909-ad5b-628ed7e00709

Zscaler PAKLOG CorkLog SplatCloak Splatdropper April 2025

ATTACK:enterprise:S0455 → uses → ATTACK:enterprise:T1010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ce071226-7abc-492c-918d-96cc195f928d

FireEye Metamorfo Apr 2018 · Fortinet Metamorfo Feb 2020

ATTACK:enterprise:S0240 → uses → ATTACK:enterprise:T1010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d1285ef9-fb7b-4d9b-9915-0b033e768a52

ATTACK:enterprise:S0692 → uses → ATTACK:enterprise:T1010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d80a85fa-5261-4274-b50e-bb82461562af

GitHub SILENTTRINITY Modules July 2019

ATTACK:enterprise:S0261 → uses → ATTACK:enterprise:T1010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d93fb52b-985e-4012-9b9f-8638e35c18a0

Symantec Catchamas April 2018

ATTACK:enterprise:S0650 → uses → ATTACK:enterprise:T1010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e2a901d9-61a4-49df-8441-3ae622879cdf

ATT QakBot April 2021

ATTACK:enterprise:S0332 → uses → ATTACK:enterprise:T1010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e678f070-2fb7-41dc-b63f-8dba148a5f97

Fortinet Remcos Campaign NOV 2024

ATTACK:enterprise:G1001 → uses → ATTACK:enterprise:T1010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e8713274-bcbc-4c18-bf06-2c2a0c01d2ba

SecureWorks August 2019

ATTACK:enterprise:S0435 → uses → ATTACK:enterprise:T1010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e98a5dc7-707a-4933-801a-b98b2e44b309

TrendMicro BlackTech June 2017 · TrendMicro BlackTech June 2017

ATTACK:enterprise:S0262 → uses → ATTACK:enterprise:T1010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ee60fb9b-b336-4919-a3fb-09d72dcd83e7

Kaspersky BlindEagle AUG 2024

ATTACK:enterprise:S0012 → uses → ATTACK:enterprise:T1010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f436f533-1116-499f-b073-9cc7698e18b0

Symantec Darkmoon Aug 2005

ATTACK:enterprise:S1044 → uses → ATTACK:enterprise:T1010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fde8c63b-13e7-47d0-836f-f8b5291bf2bd

Bitdefender FunnyDream Campaign November 2020

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.