T1010

Description from ATT&CK

Adversaries may attempt to get a listing of open application windows. Window listings could convey information about how the system is used.(Citation: Prevailion DarkWatchman 2021) For example, information about application windows could be used identify potential data to collect as well as identifying security tooling (Security Software Discovery) to evade.(Citation: ESET Grandoreiro April 2020)

Adversaries typically abuse system features for this type of enumeration. For example, they may gather information through native system features such as Command and Scripting Interpreter commands and Native API functions.

Tests

Test #1 - Find all running applications which currently have a window

This test uses System Events to find all running applications that currently have a window.

tell application "System Events" to get name of every process whose background only is false

Download Files

Test #2 - Get the frontmost application (using AppKit)

Returns the name of the currently active (frontmost) application by calling NSWorkspace via AppleScript-ObjC. Malware watches for a spoofed target application becoming frontmost before socially engineering the user.

use framework "Foundation"
use framework "AppKit"

set frontApp to current application's NSWorkspace's sharedWorkspace's frontmostApplication()
set frontAppName to frontApp's localizedName() as text
return frontAppName

Download Files

Test #3 - Get the frontmost application (using System Events)

Returns the name of the frontmost application using vanilla System Events, an alternative to the AppKit approach that does not reach into Cocoa frameworks.

tell application "System Events" to get name of first process whose frontmost is true

Download Files

References

• MITRE ATT&CK T1010
• Apple Script Language Guide