Merge pull request #209 from johnk3r/master

Create get-enumeration-function.yml

host-interaction/gui/enumerate-gui-resources.yml

@@ -0,0 +1,19 @@
+rule:
+  meta:
+    name: enumerate gui resources
+    namespace: host-interaction/gui
+    author: johnk3r
+    scope: function
+    att&ck:
+      - Discovery::Application Window Discovery [T1010]
+    examples:
+      - 5e6764534b3a1e4d3abacc4810b6985d:0x4011C0
+      - a74ee8200aace7d19dee79871bbf2ed3:0x403750
+      - 74fa32d2b277f583010b692a3f91b627:0x66BAEA67
+      - 021f49678cd633dc8cf99c61b3af3dda:0x40E44A
+  features:
+    - or:
+      - api: EnumResourceTypes
+      - api: EnumWindowStations
+      - api: EnumDesktops
+      - api: EnumWindows

nursery/enumerate-graphical-windows.yml

@@ -1,11 +0,0 @@
-rule:
-  meta:
-    name: enumerate graphical windows
-    namespace: host-interaction/gui/window/find
-    author: moritz.raabe@fireeye.com
-    scope: function
-    att&ck:
-      - Discovery::Application Window Discovery [T1010]
-  features:
-    - or:
-      - api: user32.EnumWindows