Process Discovery

4H RAT has the capability to obtain a listing of running processes (including loaded modules).^[1]

ADVSTORESHELL can list running processes.^[2]

An APT28 loader Trojan will enumerate the victim's processes searching for explorer.exe if its current process does not have necessary permissions.^[3]

APT3 has a tool that can list out currently running processes.^[4][5]

APT37's Freenki malware lists running processes using the Microsoft Windows API.^[6]

Backdoor.Oldrea collects information about running processes.^[7]

BACKSPACE may collect information about running processes.^[8]

Bankshot identifies processes and collects the process ids.^[9]

BBSRAT can list running processes.^[10]

Bisonal can obtain a list of running processes on the victim’s machine.^[11]

BLACKCOFFEE has the capability to discover processes.^[12]

BlackEnergy has gathered a process list by using Tasklist.exe.^[13][14]

Brave Prince lists the running processes.^[15]

Carbanak lists running processes.^[16]

ChChes collects its process identifier (PID) on the victim.^[17]

Cobalt Strike's "beacon" payload can collect information on process details.^[18]

Comnie uses the tasklist to view running processes on the victim’s machine.^[19]

Crimson contains a command to list processes.^[20]

Deep Panda uses the Microsoft Tasklist utility to list processes running on systems.^[21]

Derusbi collects current and parent process IDs.^[22][23]

The discovery modules used with Duqu can collect information on process details.^[24]

DustySky collects information about running processes from victims.^[25]

ELMER is capable of performing process listings.^[26]

FinFisher checks its parent process for indications that it is running in a sandbox setup.^[27][28]

FruitFly has the ability to list processes on the system.^[29]

GeminiDuke collects information on running processes and environment variables from the victim.^[30]

gh0st RAT is able to list processes.^[31]

Gold Dragon checks the running processes on the victim’s machine.^[15]

GravityRAT lists the running processes on the system.^[32]

HALFBAKED can obtain information about running processes on the victim.^[33]

Helminth has used Tasklist to get information on processes.^[3]

Honeybee gathers a list of processes using the tasklist command and then is sent back to the control server.^[34]

Hydraq creates a backdoor through which remote attackers can monitor processes.^[35][36]

iKitten lists the current processes running.^[29]

InvisiMole obtains a list of running processes.^[37]

JHUHUGIT obtains a list of running processes on the victim.^[38][39]

JPIN can list running processes.^[40]

Kasidet has the ability to search for a given process name in processes currently running in the system.^[41]

Kazuar obtains a list of running processes through WMI querying and the ps command.^[42]

Ke3chang performs process discovery using tasklist commands.^[43][44]

KEYMARBLE can obtain a list of running processes on the system.^[45]

The OsInfo function in Komplex collects a running process list.^[46]

Kwampirs collects a list of running services with the command tasklist /v.^[47]

Several Lazarus Group malware families gather a list of running processes on a victim system and send it to their C2 server. A Destover-like variant used by Lazarus Group also gathers process times.^{[48][49][50][51]}

Linfo creates a backdoor through which remote attackers can retrieve a list of running processes.^[52]

Magic Hound malware can list running processes.^[53]

MobileOrder has a command to upload information about all running processes to its C2 server.^[54]

Molerats actors obtained a list of active processes on the victim and sent them to C2 servers.^[25]

MoonWind has a command to return a list of running processes.^[55]

Mosquito runs tasklist to obtain running processes.^[56]

NavRAT uses tasklist /v to check running processes.^[57]

NETEAGLE can send process listings over the C2 channel.^[8]

OilRig has run tasklist on a victim's machine.^[58]

Orz can gather a process list from the victim.^[59]

Pasam creates a backdoor through which remote attackers can retrieve lists of running processes.^[60]

PLAINTEE performs the tasklist command to list running processes.^[61]

POORAIM can enumerate processes.^[62]

After compromising a victim, Poseidon Group lists all running processes.^[63]

PowerDuke has a command to list the victim's processes.^[64]

PowerSploit's Get-ProcessTokenPrivilege Privesc-PowerUp module can enumerate privileges for a given process.^[65][66]

POWRUNER may collect process information by running tasklist on a victim.^[67]

Proxysvc lists processes running on the system.^[51]

Pupy can list the running processes and get the process ID and parent process’s ID.^[68]

RATANKBA lists the system’s processes.^[69][70]

Remsec can obtain a process list from the victim.^[71]

RogueRobin checks the running processes for evidence it may be running in a sandbox environment. It specifically enumerates processes for Wireshark and Sysinternals.^[72]

ROKRAT lists the current running processes on the system.^[73]

RTM can obtain information about process integrity levels.^[74]

SHOTPUT has a command to obtain a process listing.^[75]

Socksbot can list all running processes.^[76]

Stealth Falcon malware gathers a list of running processes.^[77]

StreamEx has the ability to enumerate processes.^[78]

Sykipot may gather a list of running processes by running tasklist /v.^[79]

SynAck enumerates all running processes.^[80][81]

Tasklist can be used to discover processes running on a system.^[82]

Trojan.Karagany can use tasklist to collect a list of running tasks.^[7]

Turla surveys a system upon check-in to discover running processes using the tasklist /v command.^[83]

VERMIN can get a list of the processes and running tasks on the system.^[84]

Volgmer can gather a list of processes.^[85]

WINERACK can enumerate processes.^[62]

WinMM sets a WH_CBT Windows hook to collect information on process creation.^[86]

Winnti Group looked for a specific process running on infected servers.^[87]

XAgentOSX contains the getProcessList function to run ps aux to get running processes.^[88]

yty gets an output of running processes using the tasklist command.^[89]