Application AUMID Enumeration via PowerShell

Bryant Smith@flowstate

•updated Mar 25, 2026•0•25

Detects PowerShell enumerating Application User Model IDs via the notification settings registry hive, the Get-StartApps cmdlet, or the System.AppUserModel.ID extended property on .lnk shortcuts. Attackers use these to discover trusted AUMIDs to impersonate in fake toast notifications.