ToastNotify.exe AUMID Enumeration via getaumid Argument

Bryant Smith@flowstate

•updated Mar 25, 2026•0•47

Detects execution of ToastNotify.exe with the getaumid subcommand, which enumerates registered Application User Model IDs from the HKCU and HKLM notification settings registry hives. This is the reconnaissance phase of a toast notification phishing attack, used to identify trusted AUMIDs to impersonate.