The Tasklist utility displays a list of applications and services with their Process IDs (PID) for all tasks running on either a local or a remote computer. It is packaged with Windows operating systems and can be executed from the command-line interface. [1]

ID: S0057
Type: TOOL
Version: 1.1
Created: 31 May 2017
Last Modified: 12 October 2022

Techniques Used

Domain ID Name Use
Enterprise T1057 Process Discovery

Tasklist can be used to discover processes running on a system.[1]

Enterprise T1518 .001 Software Discovery: Security Software Discovery

Tasklist can be used to enumerate security software currently running on a system by process name of known products.[1]

Enterprise T1007 System Service Discovery

Tasklist can be used to discover services running on a system.[1]

Groups That Use This Software

ID Name References
G0004 Ke3chang


G0016 APT29


G0009 Deep Panda


G0010 Turla


G1006 Earth Lusca


G0027 Threat Group-3390


G0019 Naikon


G0006 APT1


G0049 OilRig



ID Name Description
C0007 FunnyDream


C0006 Operation Honeybee