Window enumeration entry points in a PowerShell script block

Siemphony@siemphonylowT1010unverified

AN0271 offers two Windows sources and only one of them can carry this behaviour. Enumerating windows through user32 reads the window manager; it does not open a handle on the process that owns the window, so Sysmon process access events are not emitted for EnumWindows or GetWindowText and a process_access rule for this technique would render in every backend and match nothing. This rule therefore takes the PowerShell script block leg, matching the user32 entry points that window enumeration goes through together with the .NET MainWindowTitle property, which is how the same listing is usually obtained without a P/Invoke declaration at all. Those names populate MITRE's AccessedFunction knob and are authored here rather than supplied by MITRE; the UserContext and TimeWindow knobs need session attributes and counting over an interval, neither of which Sigma expresses, so this is a content test on the script text alone. It follows that only enumeration written in PowerShell is visible: a compiled implant calling EnumWindows through the API leaves nothing in this channel, and the rule sees the script that was compiled rather than proof any window was actually listed. EventID 4104 requires PowerShell Script Block Logging, which is off in a default install, so confirm it is enabled before treating an absence of hits as an absence of enumeration. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0097, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

Event| where (EventID == 4104 and (ScriptBlockText contains "EnumWindows" or ScriptBlockText contains "EnumChildWindows" or ScriptBlockText contains "GetForegroundWindow" or ScriptBlockText contains "GetWindowText" or ScriptBlockText contains "GetWindowTextLength" or ScriptBlockText contains "GetWindowThreadProcessId" or ScriptBlockText contains "MainWindowTitle"))

Splunk · SPL

Run this as a search.

index=* (EventID="4104" AND (ScriptBlockText="*EnumWindows*" OR ScriptBlockText="*EnumChildWindows*" OR ScriptBlockText="*GetForegroundWindow*" OR ScriptBlockText="*GetWindowText*" OR ScriptBlockText="*GetWindowTextLength*" OR ScriptBlockText="*GetWindowThreadProcessId*" OR ScriptBlockText="*MainWindowTitle*"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE (event.code == 4104 AND (TO_LOWER(powershell.file.script_block_text) LIKE "*enumwindows*" OR TO_LOWER(powershell.file.script_block_text) LIKE "*enumchildwindows*" OR TO_LOWER(powershell.file.script_block_text) LIKE "*getforegroundwindow*" OR TO_LOWER(powershell.file.script_block_text) LIKE "*getwindowtext*" OR TO_LOWER(powershell.file.script_block_text) LIKE "*getwindowtextlength*" OR TO_LOWER(powershell.file.script_block_text) LIKE "*getwindowthreadprocessid*" OR TO_LOWER(powershell.file.script_block_text) LIKE "*mainwindowtitle*"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="5">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="EventID" type="pcre2">(?i)^4104$</field>    <field name="ScriptBlockText" type="pcre2">(?i)(EnumWindows|EnumChildWindows|GetForegroundWindow|GetWindowText|GetWindowTextLength|GetWindowThreadProcessId|MainWindowTitle)</field>    <description>Window enumeration entry points in a PowerShell script block</description>    <mitre>      <id>T1010</id>    </mitre>  </rule></group>

At a glance

Logsource: powershell / windows
Level: low
Category: discovery_recon
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 65378270-076b-45b9-9d5d-d7b7edc5a7d3

ATT&CKT1010

T1010Application Window Discovery

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessondiscovery recon

discovery reconAI draft — unreviewed

01 · What this rule detects

PowerShell script text that references the user32 entry points window enumeration goes through, or the .NET MainWindowTitle property that reaches the same listing without a P/Invoke at all. It detects the script that was compiled, not proof that any window was actually enumerated. Enumeration written in a compiled implant is invisible to this rule entirely.

02 · Telemetry you need

PowerShell EventID 4104, on the windows / powershell logsource from the brief. That requires Script Block Logging, which is off in a default install and in the MS and CIS baselines — confirm it is enabled before treating an absence of hits as an absence of enumeration.
AN0271 offers a second Windows source, process_access, and the rule deliberately does not use it. Enumerating windows through user32 reads the window manager; it never opens a handle on the process that owns the window, so Sysmon EventID 10 emits nothing for EnumWindows or GetWindowText. A process_access rule here would parse, render in all four backends, and match nothing forever. Skipping it is the most useful decision in this rule.

03 · How the logic works

Two selections, ANDed. selection_event pins EventID: 4104. selection_enumeration runs ScriptBlockText|contains over EnumWindows, EnumChildWindows, GetForegroundWindow, GetWindowText, GetWindowTextLength, GetWindowThreadProcessId, MainWindowTitle. MITRE names the knob AccessedFunction; the seven names filling it are the pipeline's own. MITRE's other two knobs, UserContext and TimeWindow, need session attributes and counting over an interval, so Sigma cannot express them and this stays a pure content test. Two flaws in that list are worth knowing. GetWindowTextLength is an unreachable branch — contains on GetWindowText already matched it, so it only makes the selector look broader than it is. More seriously, contains is a literal substring test against source text as logged; 4104 does not deobfuscate. Concatenation ('EnumWin'+'dows'), the format operator, backticks inside the name, or an Add-Type body decoded from base64 at runtime defeat all seven entries at once. That last form is the normal shape for an implant that P/Invokes user32 anyway, so the rule catches unobfuscated tooling and little else.

04 · Common false positives

MainWindowTitle will dominate, and its benign use looks least like the technique: management and patch-remediation scripts read it off Get-Process to see whether an app is open before forcing a restart, on a schedule, across the whole estate. WinForms and WPF helper snippets routinely P/Invoke GetForegroundWindow and GetWindowText to position or hide their own console. RPA tooling and inventory agents enumerate child windows by design. An administrator's diagnostic one-liner listing window titles logs identically to an intruder's. level: low follows directly from that first entry.

05 · Detection maturity

tier_1: Lowest tier. This rule has never been run against a log line. Its function list is authored, one entry is provably redundant, and its evasion profile is untested. It advances only once someone executes it against a real 4104 feed and measures how much of the volume is management scripting.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Suppress by script identity, not by dropping function names: filter the known paths and signed content of your deployment suite, then look at what remains. Delete GetWindowTextLength. Consider a companion selection on user32.dll together with DllImport to catch P/Invoke declarations whose function name has been broken up. If your SIEM carries session data, apply MITRE's UserContext knob outside Sigma — window enumeration from a non-interactive or service session is far more interesting than the same text from a logged-on admin.

Declared by the author

Software deployment and patch remediation scripts that check for open application windows before forcing a restart or closing a program, which read MainWindowTitle off Get-Process, ship with management suites and run on a schedule across the whole estate — the dominant benign volume here.
PowerShell scripts that build a graphical interface or manage their own console window, since WinForms and WPF helper snippets routinely P/Invoke GetForegroundWindow and GetWindowText from user32.dll to raise, hide or position a window.
Robotic process automation and help-desk tooling that drives a desktop application by enumerating its child windows, and desktop inventory agents that report which applications a user currently has open.
Administrators pasting a diagnostic one-liner that lists window titles to identify a hung application, which is logged identically to the same one-liner typed by an intruder.

Noise check0 of 4 fired

Fires on none of the 4 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 4 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1010, evaluated against their — events.

Share this rule

/u/siemphony/65378270-076b-45b9-9d5d-d7b7edc5a7d3

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Window enumeration entry points in a PowerShell script block

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it