Threadlinqs IntelligenceStart free

ATT&CK techniqueDiscovery

T1010 Application Window Discovery

DiscoveryEnterprise

As of 2026-10-05, T1010 (Application Window Discovery) appears in 40 tracked threats, first reported 2026-03-18 and most recently 2026-08-31, with linked actors including APT37, APT36, APT43; it most often appears alongside T1027 (Obfuscated Files or Information).

Tracked threats
404 critical, 34 high, 2 medium
First seen
2026-03-18
Last seen
2026-08-31
Threat actors
15In the threats using it
Detection rules
19Blue tier and above

Data as of:

Activity timeline

T1010 first appeared in tracked threats on and was most recently reported on . The busiest month was 2026-07 with 16 reports, and 40 of the 40 threats were reported in the twelve months to 2026-08.

How adversaries use it

T1010 Application Window Discovery is catalogued by MITRE ATT&CK under the Discovery tactic in the Enterprise matrix. Threadlinqs maps 40 of 2623 tracked threats (1.5%) to it; by severity that is 4 critical, 34 high, 2 medium.

Threats that use T1010 most often also use T1027 Obfuscated Files or Information (34 threats), T1082 System Information Discovery (31 threats), T1113 Screen Capture (31 threats), T1140 Deobfuscate/Decode Files or Information (30 threats), T1005 Data from Local System (26 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.

15 tracked threat actors appear in the threats that use T1010; the most frequent are APT37 (4), APT36 (1), APT43 (1), BlackSuit affiliate (1), Cavern Manticore (1).

Data sources

Telemetry that can reveal T1010, per MITRE ATT&CK.

  • Command — Command Execution
  • Process — OS API Execution, Process Creation

Threat actors using it

Tracked threats

The 30 most recent of 40 tracked threats that use T1010.

Detection coverage

Threadlinqs maintains 19 detection rules mapped to T1010 (SPL 4, KQL 10, Sigma 5). Rule content is available to Blue tier accounts and above; this page shows counts only.

19 detection rules (SPL/KQL/Sigma) · Blue and above. Compare plans