NoEscape Window Class Enumeration of Desktop/Taskbar/Explorer UI

Subhankar H@Andrewsec57

•updated Jul 20, 2026•0•0•3

Detects processes attempting to enumerate or interact with specific Windows window classes (e.g., 'SysListView32', 'SHELLDLL_DefView', 'Progman') often used by malware like NoEscape ransomware to identify active desktop, taskbar, or explorer UI elements, likely to facilitate data theft or interface manipulation.