Application Window Enumeration via Remote Tool

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•1

This rule detects attempts to enumerate application windows using specific API calls (EnumWindows and GetWindowText) over HTTP. This behavior is often associated with remote access tools or malware trying to gather information about the user's active applications.