Windows Ui Automation

File Organization: This skill uses split structure. Main SKILL.md contains core decision-making context. See references/ for detailed implementations.

1. Overview

Risk Level: HIGH - System-level access, process manipulation, input injection capabilities

You are an expert in Windows UI Automation with deep expertise in:

• UI Automation Framework: UIA patterns, control patterns, automation elements
• Win32 API Integration: Window management, message passing, input simulation
• Accessibility Services: Screen readers, assistive technology interfaces
• Process Security: Safe automation boundaries, privilege management

You excel at:

• Automating Windows desktop applications safely and reliably
• Implementing robust element discovery and interaction patterns
• Managing automation sessions with proper security controls
• Building accessible automation that respects system boundaries

Core Expertise Areas

1. UI Automation APIs: IUIAutomation, IUIAutomationElement, Control Patterns 2. Win32 Integration: SendInput, SetForegroundWindow, EnumWindows 3. Security Controls: Process validation, permission tiers, audit logging 4. Error Handling: Timeout management, element state verification

Core Principles

1. TDD First - Write tests before implementation code 2. Performance Aware - Optimize element discovery and caching 3. Security First - Validate processes, enforce permissions, audit all operations 4. Fail Safe - Timeouts, graceful degradation, proper cleanup

---

2. Core Responsibilities

2.1 Safe Automation Principles

When performing UI automation, you will:

• Validate target processes before any interaction
• Enforce permission tiers (read-only, standard, elevated)
• Block sensitive applications (password managers, security tools, admin consoles)
• Log all operations for audit trails
• Implement timeouts to prevent runaway automation

2.2 Security-First Approach

Every automation operation MUST: 1. Verify process identity and integrity 2. Check against blocked application list 3. Validate user authorization level 4. Log operation with correlation ID 5. Enforce timeout limits

2.3 Accessibility Compliance

All automation must:

• Respect accessibility APIs and screen reader compatibility
• Not interfere with assistive technologies
• Maintain UI state consistency
• Handle focus management properly

---

3. Technical Foundation

3.1 Core Technologies

Primary Framework: Windows UI Automation (UIA)

• Recommended: Windows 10/11 with UIA v3
• Minimum: Windows 7 with UIA v2
• Avoid: Legacy MSAA-only approaches

Key Dependencies:

UIAutomationClient.dll    # Core UIA COM interfaces
UIAutomationCore.dll      # UIA runtime
user32.dll                # Win32 input/window APIs
kernel32.dll              # Process management

3.2 Essential Libraries

---

4. Implementation Patterns

Pattern 1: Secure Element Discovery

When to use: Finding UI elements for automation

from comtypes.client import GetModule, CreateObject
import hashlib
import logging

class SecureUIAutomation:
    """Secure wrapper for UI Automation operations."""

    BLOCKED_PROCESSES = {
        'keepass.exe', '1password.exe', 'lastpass.exe',    # Password managers
        'mmc.exe', 'secpol.msc', 'gpedit.msc',             # Admin tools
        'regedit.exe', 'cmd.exe', 'powershell.exe',        # System tools
        'taskmgr.exe', 'procexp.exe',                       # Process tools
    }

    def __init__(self, permission_tier: str = 'read-only'):
        self.permission_tier = permission_tier
        self.uia = CreateObject('UIAutomationClient.CUIAutomation')
        self.logger = logging.getLogger('uia.security')
        self.operation_timeout = 30  # seconds

    def find_element(self, process_name: str, element_id: str) -> 'UIElement':
        """Find element with security validation."""
        # Security check: blocked processes
        if process_name.lower() in self.BLOCKED_PROCESSES:
            self.logger.warning(
                'blocked_process_access',
                process=process_name,
                reason='security_policy'
            )
            raise SecurityError(f"Access to {process_name} is blocked")

        # Find process window
        root = self.uia.GetRootElement()
        condition = self.uia.CreatePropertyCondition(
            30003,  # UIA_NamePropertyId
            process_name
        )

        element = root.FindFirst(4, condition)  # TreeScope_Children

        if element:
            self._audit_log('element_found', process_name, element_id)

        return element

    def _audit_log(self, action: str, process: str, element: str):
        """Log operation for audit trail."""
        self.logger.info(
            f'uia.{action}',
            extra={
                'process': process,
                'element': element,
                'permission_tier': self.permission_tier,
                'correlation_id': self._get_correlation_id()
            }
        )

Pattern 2: Safe Input Simulation

When to use: Sending keyboard/mouse input to applications

import ctypes
from ctypes import wintypes
import time

class SafeInputSimulator:
    """Input simulation with security controls."""

    # Blocked key combinations
    BLOCKED_COMBINATIONS = [
        ('ctrl', 'alt', 'delete'),
        ('win', 'r'),  # Run dialog
        ('win', 'x'),  # Power user menu
    ]

    def __init__(self, permission_tier: str):
        if permission_tier == 'read-only':
            raise PermissionError("Input simulation requires 'standard' or 'elevated' tier")

        self.permission_tier = permission_tier
        self.rate_limit = 100  # max inputs per second
        self._input_count = 0
        self._last_reset = time.time()

    def send_keys(self, keys: str, target_hwnd: int):
        """Send keystrokes with validation."""
        # Rate limiting
        self._check_rate_limit()

        # Validate target window
        if not self._is_valid_target(target_hwnd):
            raise SecurityError("Invalid target window")

        # Check for blocked combinations
        if self._is_blocked_combination(keys):
            raise SecurityError(f"Key combination '{keys}' is blocked")

        # Ensure target has focus
        if not self._safe_set_focus(target_hwnd):
            raise AutomationError("Could not set focus to target")

        # Send input
        self._send_input_safe(keys)

    def _check_rate_limit(self):
        """Prevent input flooding."""
        now = time.time()
        if now - self._last_reset > 1.0:
            self._input_count = 0
            self._last_reset = now

        self._input_count += 1
        if self._input_count > self.rate_limit:
            raise RateLimitError("Input rate limit exceeded")

Pattern 3: Process Validation

When to use: Before any automation interaction

import psutil
import hashlib

class ProcessValidator:
    """Validate processes before automation."""

    def __init__(self):
        self.known_hashes = {}  # Load from secure config

    def validate_process(self, pid: int) -> bool:
        """Validate process identity and integrity."""
        try:
            proc = psutil.Process(pid)

            # Check process name against blocklist
            if proc.name().lower() in BLOCKED_PROCESSES:
                return False

            # Verify executable integrity (optional, HIGH security)
            exe_path = proc.exe()
            if not self._verify_integrity(exe_path):
                return False

            # Check process owner
            if not self._check_owner(proc):
                return False

            return True

        except psutil.NoSuchProcess:
            return False

    def _verify_integrity(self, exe_path: str) -> bool:
        """Verify executable hash against known good values."""
        if exe_path not in self.known_hashes:
            return True  # Skip if no hash available

        with open(exe_path, 'rb') as f:
            file_hash = hashlib.sha256(f.read()).hexdigest()

        return file_hash == self.known_hashes[exe_path]

Pattern 4: Timeout Enforcement

When to use: All automation operations

import signal
from contextlib import contextmanager

class TimeoutManager:
    """Enforce operation timeouts."""

    DEFAULT_TIMEOUT = 30  # seconds
    MAX_TIMEOUT = 300     # 5 minutes absolute max

    @contextmanager
    def timeout(self, seconds: int = DEFAULT_TIMEOUT):
        """Context manager for operation timeout."""
        if seconds > self.MAX_TIMEOUT:
            seconds = self.MAX_TIMEOUT

        def handler(signum, frame):
            raise TimeoutError(f"Operation timed out after {seconds}s")

        old_handler = signal.signal(signal.SIGALRM, handler)
        signal.alarm(seconds)

        try:
            yield
        finally:
            signal.alarm(0)
            signal.signal(signal.SIGALRM, old_handler)

# Usage
timeout_mgr = TimeoutManager()

with timeout_mgr.timeout(10):
    element = automation.find_element('notepad.exe', 'Edit1')

---

5. Security Standards

5.1 Critical Vulnerabilities (Top 5)

Research Date: 2025-01-15

1. UI Automation Privilege Escalation (CVE-2023-28218)

• Severity: HIGH
• Description: UIA can be abused to inject input into elevated processes
• Mitigation: Validate process elevation level before interaction

2. SendInput Injection (CVE-2022-30190)

• Severity: CRITICAL
• Description: Input injection to bypass security prompts
• Mitigation: Block input to UAC dialogs, security prompts

3. Window Message Spoofing (CWE-290)

• Severity: HIGH
• Description: Spoofed messages to privileged windows
• Mitigation: Validate message origin, use UIPI

4. Process Token Theft (CVE-2021-1732)

• Severity: CRITICAL
• Description: Win32k elevation via token manipulation
• Mitigation: Run with minimum required privileges

5. Accessibility API Abuse (CWE-269)

• Severity: HIGH
• Description: UIA used to access restricted content
• Mitigation: Implement process blocklists, audit logging

For complete vulnerability analysis: See references/security-examples.md

5.2 OWASP Top 10 2025 Mapping

For detailed OWASP guidance: See references/security-examples.md

5.3 Permission Tier Model

PERMISSION_TIERS = {
    'read-only': {
        'allowed_operations': ['find_element', 'get_property', 'get_pattern'],
        'blocked_operations': ['send_input', 'click', 'set_value'],
        'timeout': 30,
    },
    'standard': {
        'allowed_operations': ['find_element', 'get_property', 'send_input', 'click'],
        'blocked_operations': ['elevated_process_access', 'system_keys'],
        'timeout': 60,
    },
    'elevated': {
        'allowed_operations': ['*'],
        'blocked_operations': ['admin_tools', 'security_software'],
        'timeout': 120,
        'requires_approval': True,
    }
}

---

6. Implementation Workflow (TDD)

Step 1: Write Failing Test First

# tests/test_ui_automation.py
import pytest
from unittest.mock import MagicMock, patch

class TestSecureUIAutomation:
    """TDD tests for UI automation security."""

    def test_blocks_password_manager_access(self, automation):
        """Test that blocked processes are rejected."""
        with pytest.raises(SecurityError, match="blocked"):
            automation.find_element('keepass.exe', 'PasswordField')

    def test_validates_process_before_input(self, automation):
        """Test process validation before any input."""
        with patch.object(automation, '_validate_process') as mock_validate:
            mock_validate.return_value = False
            with pytest.raises(SecurityError):
                automation.send_keys('test', hwnd=12345)
            mock_validate.assert_called_once()

    def test_enforces_rate_limiting(self, input_simulator):
        """Test input rate limiting prevents flooding."""
        for _ in range(100):
            input_simulator.send_keys('a', hwnd=12345)
        with pytest.raises(RateLimitError):
            input_simulator.send_keys('a', hwnd=12345)

    def test_timeout_prevents_hanging(self, automation):
        """Test timeout enforcement on element search."""
        with pytest.raises(TimeoutError):
            with automation.timeout(0.001):
                automation.find_element('app.exe', 'NonExistent')

@pytest.fixture
def automation():
    return SecureUIAutomation(permission_tier='standard')

Step 2: Implement Minimum to Pass

class SecureUIAutomation:
    BLOCKED_PROCESSES = {'keepass.exe', '1password.exe'}

    def find_element(self, process_name: str, element_id: str):
        if process_name.lower() in self.BLOCKED_PROCESSES:
            raise SecurityError(f"Access to {process_name} is blocked")
        # Minimal implementation

Step 3: Refactor with Full Patterns

Apply security patterns from Section 4 after tests pass.

Step 4: Run Full Verification

# Run all tests with coverage
pytest tests/test_ui_automation.py -v --cov=src/automation --cov-report=term-missing

# Run security-specific tests
pytest tests/ -k "security or blocked" -v

# Type checking
mypy src/automation --strict

---

7. Performance Patterns

Pattern 1: Element Caching

# BAD: Re-find element every operation
for i in range(100):
    element = uia.find_element('app.exe', 'TextField')
    element.send_keys(str(i))

# GOOD: Cache element reference
element = uia.find_element('app.exe', 'TextField')
for i in range(100):
    if element.is_valid():
        element.send_keys(str(i))
    else:
        element = uia.find_element('app.exe', 'TextField')

Pattern 2: Scope Limiting

# BAD: Search from root every time
root = uia.GetRootElement()
element = root.FindFirst(TreeScope.Descendants, condition)  # Searches entire desktop

# GOOD: Narrow search scope
app_window = uia.find_window('notepad.exe')
element = app_window.FindFirst(TreeScope.Children, condition)  # Only direct children

Pattern 3: Async Operations

# BAD: Blocking wait for element
while not element.is_enabled():
    time.sleep(0.1)  # Blocks thread

# GOOD: Async with timeout
import asyncio

async def wait_for_element(element, timeout=10):
    start = asyncio.get_event_loop().time()
    while not element.is_enabled():
        if asyncio.get_event_loop().time() - start > timeout:
            raise TimeoutError("Element not enabled")
        await asyncio.sleep(0.05)  # Non-blocking

Pattern 4: COM Object Pooling

# BAD: Create new COM object per operation
def find_element(name):
    uia = CreateObject('UIAutomationClient.CUIAutomation')  # Expensive
    return uia.GetRootElement().FindFirst(...)

# GOOD: Reuse COM object
class UIAutomationPool:
    _instance = None

    @classmethod
    def get_automation(cls):
        if cls._instance is None:
            cls._instance = CreateObject('UIAutomationClient.CUIAutomation')
        return cls._instance

Pattern 5: Condition Optimization

# BAD: Multiple sequential conditions
name_cond = uia.CreatePropertyCondition(UIA_NamePropertyId, 'Submit')
type_cond = uia.CreatePropertyCondition(UIA_ControlTypeId, ButtonControl)
element = root.FindFirst(TreeScope.Descendants, name_cond)
if element.ControlType != ButtonControl:
    element = None

# GOOD: Combined condition for single search
and_cond = uia.CreateAndCondition(
    uia.CreatePropertyCondition(UIA_NamePropertyId, 'Submit'),
    uia.CreatePropertyCondition(UIA_ControlTypeId, ButtonControl)
)
element = root.FindFirst(TreeScope.Descendants, and_cond)

---

8. Common Mistakes

8.1 Critical Security Anti-Patterns

Never: Automate Without Process Validation

# BAD: No validation
element = uia.find_element_by_name('Password')
element.send_keys(password)

# GOOD: Full validation
if validator.validate_process(target_pid):
    if automation.permission_tier != 'read-only':
        element = automation.find_element(process_name, 'Password')
        element.send_keys(password)

Never: Skip Timeout Enforcement

# BAD: No timeout
element = uia.find_element(condition)  # Could hang forever

# GOOD: With timeout
with timeout_mgr.timeout(10):
    element = uia.find_element(condition)

Never: Allow System Key Combinations

# BAD: Allow any keys
def send_keys(keys):
    SendInput(keys)

# GOOD: Block dangerous combinations
def send_keys(keys):
    if is_blocked_combination(keys):
        raise SecurityError("Blocked key combination")
    SendInput(keys)

---

13. Pre-Implementation Checklist

Phase 1: Before Writing Code

• [ ] Read threat model in references/threat-model.md
• [ ] Identify target processes and required permission tier
• [ ] Write failing tests for security requirements
• [ ] Write failing tests for expected functionality
• [ ] Define timeout limits for all operations

Phase 2: During Implementation

• [ ] Implement minimum code to pass security tests first
• [ ] Process validation for all target interactions
• [ ] Blocked application list configured
• [ ] Permission tier enforcement active
• [ ] Input rate limiting implemented
• [ ] Timeout enforcement on all operations
• [ ] Audit logging for all actions

Phase 3: Before Committing

• [ ] All tests pass: pytest tests/ -v
• [ ] Security tests pass: pytest tests/ -k security
• [ ] Type checking passes: mypy src/automation --strict
• [ ] No hardcoded credentials or sensitive data
• [ ] Audit logs properly configured
• [ ] Performance targets met (element lookup <100ms)

---

14. Summary

Your goal is to create Windows UI automation that is:

• Secure: Strict process validation, permission tiers, and audit logging
• Reliable: Timeout enforcement, error handling, and state verification
• Accessible: Respects accessibility APIs and assistive technologies

You understand that UI automation carries significant security risks. You balance automation power with strict controls, ensuring operations are logged, validated, and bounded.

Security Reminders: 1. Always validate target process identity 2. Never automate blocked security applications 3. Enforce timeouts on all operations 4. Log every operation with correlation IDs 5. Implement permission tiers appropriate to risk

Automation should enhance productivity while maintaining system security boundaries.

---

References

• Advanced Patterns: See references/advanced-patterns.md
• Security Examples: See references/security-examples.md
• Threat Model: See references/threat-model.md

Windows UI Automation - Advanced Patterns

Pattern: Secure Automation Session

from contextlib import contextmanager
import uuid

class SecureAutomationSession:
    """Managed automation session with full security controls."""

    def __init__(self, permission_tier: str = 'read-only'):
        self.session_id = str(uuid.uuid4())
        self.permission_tier = permission_tier
        self.uia = None
        self.audit_logger = UIAuditLogger()
        self.timeout_manager = TimeoutManager()
        self.guard = AutomationGuard()

    @contextmanager
    def session(self):
        """Context manager for safe automation session."""
        try:
            self._initialize()
            yield self
        finally:
            self._cleanup()

    def _initialize(self):
        """Initialize automation with security checks."""
        self.uia = CreateObject('UIAutomationClient.CUIAutomation')
        self.audit_logger.log_session_start(self.session_id, self.permission_tier)

    def _cleanup(self):
        """Clean up automation session."""
        self.audit_logger.log_session_end(self.session_id)
        self.uia = None

    def find_and_interact(self, process: str, element_id: str, action: str, **kwargs):
        """Find element and perform action with full validation."""
        # Check limits
        self.guard.check_limits()

        # Validate process
        pid = get_process_pid(process)
        if not ProcessValidator().validate_process(pid):
            raise SecurityError(f"Process validation failed: {process}")

        # Find element with timeout
        with self.timeout_manager.timeout(30):
            element = self._find_element(process, element_id)

        # Perform action based on permission tier
        if action == 'get_value':
            return self._get_value(element)
        elif action == 'click':
            return self._click(element)
        elif action == 'send_keys':
            return self._send_keys(element, kwargs.get('keys', ''))

    def _find_element(self, process: str, element_id: str):
        """Find element with caching and validation."""
        root = self.uia.GetRootElement()
        # Implementation details...
        pass

Pattern: Hierarchical Element Discovery

class ElementDiscovery:
    """Safe hierarchical element discovery."""

    def find_element_path(self, path: list[str]) -> 'UIElement':
        """Find element by path with validation at each level."""
        current = self.uia.GetRootElement()

        for level, identifier in enumerate(path):
            # Validate identifier
            if not validate_element_identifier(identifier):
                raise ValidationError(f"Invalid identifier: {identifier}")

            # Find child element
            child = self._find_child(current, identifier)
            if not child:
                raise ElementNotFoundError(f"Element not found: {identifier}")

            # Validate we can access this element
            if not self._can_access(child):
                raise SecurityError(f"Access denied to element: {identifier}")

            current = child

        return current

Pattern: Robust Wait Conditions

class WaitConditions:
    """Wait for UI conditions with timeout and safety."""

    def wait_for_element(
        self,
        condition: callable,
        timeout: int = 30,
        poll_interval: float = 0.5
    ) -> 'UIElement':
        """Wait for element matching condition."""
        start = time.time()

        while time.time() - start < timeout:
            try:
                element = condition()
                if element:
                    return element
            except Exception:
                pass

            time.sleep(poll_interval)

        raise TimeoutError(f"Element not found within {timeout}s")

    def wait_for_window(self, title: str, timeout: int = 30):
        """Wait for window to appear."""
        return self.wait_for_element(
            lambda: self._find_window_by_title(title),
            timeout=timeout
        )

    def wait_for_element_state(self, element, state: str, timeout: int = 10):
        """Wait for element to reach state."""
        return self.wait_for_element(
            lambda: element if element.get_state() == state else None,
            timeout=timeout
        )

Pattern: Multi-Monitor Support

class MultiMonitorAutomation:
    """Handle automation across multiple monitors."""

    def get_element_monitor(self, element) -> int:
        """Determine which monitor contains element."""
        rect = element.bounding_rectangle
        monitors = self._enumerate_monitors()

        for idx, monitor in enumerate(monitors):
            if self._rect_in_monitor(rect, monitor):
                return idx

        return 0  # Primary monitor fallback

    def ensure_visible(self, element):
        """Ensure element is visible on screen."""
        rect = element.bounding_rectangle
        monitor = self.get_element_monitor(element)

        if not self._is_fully_visible(rect, monitor):
            element.scroll_into_view()

Pattern: Clipboard Security

class SecureClipboard:
    """Secure clipboard operations for automation."""

    def copy_to_clipboard(self, text: str, clear_after: int = 30):
        """Copy text with automatic clearing."""
        # Set clipboard
        ctypes.windll.user32.OpenClipboard(0)
        ctypes.windll.user32.EmptyClipboard()
        # ... set text ...
        ctypes.windll.user32.CloseClipboard()

        # Schedule clearing
        threading.Timer(clear_after, self._clear_clipboard).start()

    def _clear_clipboard(self):
        """Clear clipboard contents."""
        ctypes.windll.user32.OpenClipboard(0)
        ctypes.windll.user32.EmptyClipboard()
        ctypes.windll.user32.CloseClipboard()

Pattern: Screenshot Redaction

class SecureScreenCapture:
    """Screenshot capture with sensitive content redaction."""

    def capture_with_redaction(self, hwnd: int) -> bytes:
        """Capture window with sensitive areas redacted."""
        # Capture screenshot
        image = self._capture_window(hwnd)

        # Find sensitive elements
        sensitive_rects = self._find_sensitive_regions(hwnd)

        # Redact sensitive areas
        for rect in sensitive_rects:
            image = self._redact_region(image, rect)

        return image

    def _find_sensitive_regions(self, hwnd: int) -> list:
        """Find regions containing sensitive content."""
        regions = []
        elements = self._enumerate_elements(hwnd)

        for element in elements:
            if is_credential_element(element.name):
                regions.append(element.bounding_rectangle)

        return regions

Windows UI Automation - Security Examples

5.1 Domain-Specific Vulnerability Landscape (2022-2025)

Research Date: 2025-01-15

Vulnerability 1: CVE-2023-28218 - UI Automation Privilege Escalation

Severity: HIGH (CVSS 7.8) CWE: CWE-269 (Improper Privilege Management)

Description: Windows UI Automation framework allows lower-privileged processes to interact with higher-privileged windows through UIA patterns, enabling privilege escalation attacks.

Attack Scenario:

1. Attacker runs unprivileged process with UIA client
2. Finds elevated application window (e.g., Task Manager running as admin)
3. Uses UIA to send input to elevated process
4. Executes commands with elevated privileges

Mitigation:

def validate_elevation_match(source_pid: int, target_pid: int) -> bool:
    """Ensure automation cannot cross elevation boundaries."""
    source_elevated = is_elevated_process(source_pid)
    target_elevated = is_elevated_process(target_pid)

    if target_elevated and not source_elevated:
        logger.warning(
            'elevation_mismatch',
            source_pid=source_pid,
            target_pid=target_pid
        )
        return False
    return True

Vulnerability 2: CVE-2022-30190 - Input Injection to Security Dialogs

Severity: CRITICAL (CVSS 9.3) CWE: CWE-74 (Injection)

Description: SendInput API can inject keystrokes into UAC prompts and security dialogs, bypassing user consent.

Attack Scenario:

1. Malware triggers UAC prompt
2. Uses SendInput to press Enter/Tab to approve
3. Gains elevated privileges without user interaction

Mitigation:

BLOCKED_WINDOW_CLASSES = [
    '#32770',           # Dialog boxes (includes UAC)
    'Credential Dialog',
    'Windows Security',
]

def is_security_dialog(hwnd: int) -> bool:
    """Check if window is a security dialog."""
    class_name = get_window_class(hwnd)
    return class_name in BLOCKED_WINDOW_CLASSES

Vulnerability 3: CVE-2021-1732 - Win32k Elevation of Privilege

Severity: CRITICAL (CVSS 7.8) CWE: CWE-416 (Use After Free)

Description: Win32k kernel component vulnerability exploited through window management APIs.

Mitigation: Keep Windows updated, run automation with minimal privileges.

Vulnerability 4: CWE-290 - Window Message Spoofing

Severity: HIGH CWE: CWE-290 (Authentication Bypass by Spoofing)

Description: Applications may trust window messages without verifying origin.

Mitigation:

def send_message_safe(hwnd: int, msg: int, wparam: int, lparam: int):
    """Send message with origin validation."""
    # Use SendMessageTimeout instead of SendMessage
    result = ctypes.windll.user32.SendMessageTimeoutW(
        hwnd, msg, wparam, lparam,
        0x0002,  # SMTO_ABORTIFHUNG
        5000,    # 5 second timeout
        ctypes.byref(result_value)
    )
    if result == 0:
        raise TimeoutError("Window not responding")

Vulnerability 5: CWE-269 - Accessibility API Abuse

Severity: HIGH CWE: CWE-269 (Improper Privilege Management)

Description: UIA can access sensitive data from applications that expose it through accessibility APIs.

Mitigation:

SENSITIVE_PATTERNS = [
    'password', 'secret', 'token', 'key', 'credential'
]

def filter_sensitive_properties(element_name: str, value: str) -> str:
    """Redact sensitive values from automation access."""
    name_lower = element_name.lower()
    if any(pattern in name_lower for pattern in SENSITIVE_PATTERNS):
        return '[REDACTED]'
    return value

---

5.2 OWASP Top 10 2025 - Detailed Guidance

A01:2025 - Broken Access Control

Risk Level for UI Automation: CRITICAL

Why This Matters: UIA can access any window in the same session, potentially crossing security boundaries between applications.

Common Scenarios: 1. Accessing password manager vaults 2. Reading sensitive data from privileged applications 3. Injecting input into elevated processes

Implementation:

class AccessController:
    """Enforce access control for UI Automation."""

    def check_access(self, source: Process, target: Process, operation: str) -> bool:
        # Check blocked applications
        if target.name.lower() in self.blocked_apps:
            self._audit_blocked_access(source, target, 'blocked_app')
            return False

        # Check elevation boundaries
        if target.is_elevated and not source.is_elevated:
            self._audit_blocked_access(source, target, 'elevation_boundary')
            return False

        # Check permission tier
        if operation not in self.permission_tier.allowed_operations:
            self._audit_blocked_access(source, target, 'permission_denied')
            return False

        return True

A02:2025 - Security Misconfiguration

Risk Level: HIGH

Why This Matters: Default UIA settings allow broad access without restrictions.

Secure Configuration:

SECURE_DEFAULTS = {
    'default_permission_tier': 'read-only',
    'default_timeout': 30,
    'enable_audit_logging': True,
    'block_elevated_targets': True,
    'block_system_processes': True,
    'rate_limit_inputs': 100,
}

A05:2025 - Injection

Risk Level: CRITICAL

Why This Matters: SendInput and SendMessage can inject malicious input into applications.

Testing Approach:

def test_injection_prevention():
    """Test that dangerous key combinations are blocked."""
    blocked_keys = [
        'ctrl+alt+delete',
        'win+r',
        'alt+f4',  # on system processes
    ]

    for keys in blocked_keys:
        with pytest.raises(SecurityError):
            input_simulator.send_keys(keys, target_hwnd)

A07:2025 - Authentication Failures

Risk Level: HIGH

Why This Matters: Must verify process identity before automation.

Implementation:

def verify_process_identity(pid: int, expected_exe: str) -> bool:
    """Verify process is what it claims to be."""
    proc = psutil.Process(pid)

    # Check executable path
    if proc.exe().lower() != expected_exe.lower():
        return False

    # Check digital signature (Windows-specific)
    if not verify_authenticode_signature(proc.exe()):
        return False

    return True

---

Input Validation for UIA

Element Name Validation

import re

def validate_element_identifier(identifier: str) -> bool:
    """Validate element identifier is safe."""
    # Only allow alphanumeric, underscore, hyphen
    pattern = r'^[a-zA-Z0-9_-]{1,255}$'
    return bool(re.match(pattern, identifier))

Property Value Sanitization

def sanitize_property_value(value: str, max_length: int = 1000) -> str:
    """Sanitize property values before use."""
    if not value:
        return ''

    # Truncate to max length
    value = value[:max_length]

    # Remove control characters
    value = ''.join(char for char in value if ord(char) >= 32 or char in '\n\r\t')

    return value

---

Audit Logging Examples

import json
import logging
from datetime import datetime

class UIAuditLogger:
    """Comprehensive audit logging for UI Automation."""

    def __init__(self):
        self.logger = logging.getLogger('uia.audit')
        self.logger.setLevel(logging.INFO)

    def log_operation(
        self,
        operation: str,
        target_process: str,
        target_element: str,
        permission_tier: str,
        success: bool,
        error: str = None
    ):
        """Log automation operation."""
        record = {
            'timestamp': datetime.utcnow().isoformat(),
            'event_type': 'uia_operation',
            'operation': operation,
            'target': {
                'process': target_process,
                'element': target_element,
            },
            'context': {
                'permission_tier': permission_tier,
                'success': success,
                'error': error,
            }
        }

        self.logger.info(json.dumps(record))

    def log_blocked_access(
        self,
        reason: str,
        target_process: str,
        operation: str
    ):
        """Log blocked access attempt."""
        record = {
            'timestamp': datetime.utcnow().isoformat(),
            'event_type': 'uia_blocked',
            'reason': reason,
            'target_process': target_process,
            'attempted_operation': operation,
        }

        self.logger.warning(json.dumps(record))

Windows UI Automation - Threat Model

Threat Model Overview

Domain Risk Level: HIGH Attack Surface: System-wide window access, input injection, process interaction

Assets to Protect

1. User Credentials - Sensitivity: CRITICAL

• Passwords, tokens, API keys visible in application windows

2. Sensitive Data - Sensitivity: HIGH

• Financial data, personal information, business documents

3. System Integrity - Sensitivity: CRITICAL

• Prevention of unauthorized system changes via automation

4. User Privacy - Sensitivity: HIGH

• Screen content, application usage patterns

Threat Actors

1. Malware Authors - Automated data theft via UIA 2. Malicious Insiders - Abuse of automation privileges 3. Supply Chain Attackers - Compromised automation libraries

---

Attack Scenario 1: Privilege Escalation via UIA

Threat Category: OWASP A01:2025 - Broken Access Control Threat Level: CRITICAL

Attack Description: Attacker uses UI Automation to interact with elevated processes, gaining higher privileges.

Attack Flow:

1. Attacker runs low-privilege automation client
2. Enumerates windows to find elevated process (e.g., admin cmd)
3. Uses UIA to send input to elevated window
4. Executes commands with admin privileges
5. Installs persistence, exfiltrates data

Impact:

• Confidentiality: CRITICAL - Full system access
• Integrity: CRITICAL - System modification
• Availability: HIGH - System destruction possible

Mitigation:

def block_elevation_crossing(source_pid: int, target_pid: int):
    """Prevent automation across elevation boundaries."""
    source_token = get_process_token(source_pid)
    target_token = get_process_token(target_pid)

    if is_elevated(target_token) and not is_elevated(source_token):
        raise SecurityError("Cannot automate elevated process from non-elevated context")

---

Attack Scenario 2: Credential Theft via Screen Scraping

Threat Category: OWASP A07:2025 - Authentication Failures Threat Level: CRITICAL

Attack Description: Malware uses UIA to read password fields and credential dialogs.

Attack Flow:

1. Monitor for password manager windows
2. Use UIA to enumerate text elements
3. Read password field values (if accessible)
4. Capture Windows credential dialogs
5. Exfiltrate credentials

Mitigation:

CREDENTIAL_INDICATORS = [
    'password', 'secret', 'pin', 'credential', 'token'
]

def is_credential_element(element_name: str) -> bool:
    """Detect and block access to credential elements."""
    return any(ind in element_name.lower() for ind in CREDENTIAL_INDICATORS)

def get_element_value(element) -> str:
    if is_credential_element(element.name):
        audit_log('blocked_credential_access', element.name)
        raise SecurityError("Access to credential elements blocked")
    return element.value

---

Attack Scenario 3: Input Injection to Bypass Security

Threat Category: OWASP A05:2025 - Injection Threat Level: CRITICAL

Attack Description: Automated input injection to approve security prompts without user consent.

Attack Flow:

1. Malware triggers UAC prompt
2. Uses SendInput to simulate Enter key
3. UAC prompt approved without user
4. Malware gains elevation

Mitigation:

SECURITY_WINDOW_CLASSES = ['#32770', 'Credential Dialog Xaml Host']

def block_security_dialog_input(target_hwnd: int):
    """Block input to security dialogs."""
    class_name = get_window_class(target_hwnd)
    if class_name in SECURITY_WINDOW_CLASSES:
        raise SecurityError("Input to security dialogs blocked")

---

Attack Scenario 4: Malicious Automation Library

Threat Category: OWASP A03:2025 - Supply Chain Failures Threat Level: HIGH

Attack Description: Compromised automation library (pywinauto, comtypes) executes malicious code.

Attack Flow:

1. Attacker publishes trojanized pywinauto
2. Developer installs malicious package
3. Library exfiltrates automation targets
4. Sensitive data stolen

Mitigation:

• Pin dependency versions
• Verify package hashes
• Use private package registry
• Regular security audits

---

Attack Scenario 5: Runaway Automation DoS

Threat Category: OWASP A10:2025 - Exceptional Conditions Threat Level: MEDIUM

Attack Description: Automation without timeouts consumes resources or hangs system.

Attack Flow:

1. Automation script enters infinite loop
2. Continuous input injection
3. System becomes unresponsive
4. User locked out

Mitigation:

class AutomationGuard:
    """Prevent runaway automation."""

    MAX_OPERATIONS = 1000
    MAX_DURATION = 300  # seconds

    def __init__(self):
        self.operation_count = 0
        self.start_time = time.time()

    def check_limits(self):
        self.operation_count += 1

        if self.operation_count > self.MAX_OPERATIONS:
            raise AutomationError("Operation limit exceeded")

        if time.time() - self.start_time > self.MAX_DURATION:
            raise AutomationError("Duration limit exceeded")

---

STRIDE Analysis

---

Security Controls Summary

Preventive Controls

• Process validation before automation
• Blocked application list
• Permission tier enforcement
• Input rate limiting
• Elevation boundary checks

Detective Controls

• Comprehensive audit logging
• Anomaly detection
• Failed access attempt alerts
• Resource usage monitoring

Corrective Controls

• Automatic session termination on violations
• Incident response procedures
• Credential rotation after suspected compromise