Skip to content

T1010: Application Window Discovery

Retrieving running application window titles:

{% code-tabs %} {% code-tabs-item title="attacker@victim" %}

get-process | where-object {$_.mainwindowtitle -ne ""} | Select-Object mainwindowtitle
{% endcode-tabs-item %} {% endcode-tabs %}

A COM method that also includes the process path and window location coordinates:

{% code-tabs %} {% code-tabs-item title="attacker@victim" %}

[activator]::CreateInstance([type]::GetTypeFromCLSID("13709620-C279-11CE-A49E-444553540000")).windows()
{% endcode-tabs-item %} {% endcode-tabs %}

References

{% embed url="https://attack.mitre.org/wiki/Technique/T1010" %}