Process Discovery

4H RAT has the capability to obtain a listing of running processes (including loaded modules).^[85]

ADVSTORESHELL can list running processes.^[45]

Agent Tesla lists the current running processes on the system.^[53]

APT1 gathered a list of running processes on the system using tasklist /v.^[111]

An APT28 loader Trojan will enumerate the victim's processes searching for explorer.exe if its current process does not have necessary permissions.^[34]

APT3 has a tool that can list out currently running processes.^[114][115]

APT37's Freenki malware lists running processes using the Microsoft Windows API.^[109]

APT38 leveraged Sysmon to understand the processes, services in the organization.^[112]

Astaroth searches for different processes on the system.^[97]

Azorult can collect a list of running processes by calling CreateToolhelp32Snapshot.^[60][61]

BabyShark has executed the tasklist command. ^[107]

Backdoor.Oldrea collects information about running processes.^[13]

BACKSPACE may collect information about running processes.^[14]

Bankshot identifies processes and collects the process ids.^[42]

BBSRAT can list running processes.^[23]

BISCUIT has a command to enumerate running processes and identify their owners.^[71]

Bisonal can obtain a list of running processes on the victim’s machine.^[35]

BLACKCOFFEE has the capability to discover processes.^[57]

BlackEnergy has gathered a process list by using Tasklist.exe.^[32][33]

Brave Prince lists the running processes.^[52]

Cannon can obtain a list of processes running on the system.^[27][28]

Carbanak lists running processes.^[31]

Carbon can list the processes on the victim’s machine.^[66]

Cardinal RAT contains watchdog functionality that ensures its process is always running, else spawns a new instance.^[72]

ChChes collects its process identifier (PID) on the victim.^[58]

Cobalt Strike's "beacon" payload can collect information on process details.^[2]

Comnie uses the tasklist to view running processes on the victim’s machine.^[8]

Crimson contains a command to list processes.^[40]

DarkComet can list active processes running on the victim’s machine.^[65]

Darkhotel has searched for anti-malware strings and anti-virus processes running on the system.^[125]

Deep Panda uses the Microsoft Tasklist utility to list processes running on systems.^[117]

Derusbi collects current and parent process IDs.^[43][44]

The discovery modules used with Duqu can collect information on process details.^[82]

DustySky collects information about running processes from victims.^[12]

Elise enumerates processes via the tasklist command.^[62]

ELMER is capable of performing process listings.^[17]

Emotet has been observed enumerating local processes.^[96]

Empire can find information about processes running on local and remote systems.^[6]

Epic uses the tasklist /v command to obtain a list of processes.^[69][70]

EvilBunny has used EnumProcesses() to identify how many process are running in the environment.^[103]

FELIXROOT collects a list of running processes.^[78]

Final1stspy obtains a list of running processes.^[79]

FinFisher checks its parent process for indications that it is running in a sandbox setup.^[83][84]

FruitFly has the ability to list processes on the system.^[22]

Fysbis can collect information about running processes. ^[106]

GeminiDuke collects information on running processes and environment variables from the victim.^[29]

gh0st RAT has the capability to list processes.^[89]

Gold Dragon checks the running processes on the victim’s machine.^[52]

GravityRAT lists the running processes on the system.^[50]

HALFBAKED can obtain information about running processes on the victim.^[68]

Helminth has used Tasklist to get information on processes.^[34]

Honeybee gathers a list of processes using the tasklist command and then is sent back to the control server.^[110]

Hydraq creates a backdoor through which remote attackers can monitor processes.^[54][55]

iKitten lists the current processes running.^[22]

InvisiMole obtains a list of running processes.^[10]

Ixeshe can list running processes.^[101]

JHUHUGIT obtains a list of running processes on the victim.^[86][87]

JPIN can list running processes.^[7]

jRAT can query and kill system processes.^[98]

Kasidet has the ability to search for a given process name in processes currently running in the system.^[92]

Kazuar obtains a list of running processes through WMI querying and the ps command.^[37]

Ke3chang performs process discovery using tasklist commands.^[118][119]

KEYMARBLE can obtain a list of running processes on the system.^[21]

The OsInfo function in Komplex collects a running process list.^[74]

Kwampirs collects a list of running services with the command tasklist /v.^[41]

Several Lazarus Group malware families gather a list of running processes on a victim system and send it to their C2 server. A Destover-like variant used by Lazarus Group also gathers process times.^{[120][121][122][39]}

Linfo creates a backdoor through which remote attackers can retrieve a list of running processes.^[80]

Machete has a component to check for running processes to look for web browsers. ^[104]

Magic Hound malware can list running processes.^[126]

MobileOrder has a command to upload information about all running processes to its C2 server.^[67]

Molerats actors obtained a list of active processes on the victim and sent them to C2 servers.^[12]

MoonWind has a command to return a list of running processes.^[75]

Mosquito runs tasklist to obtain running processes.^[19]

MuddyWater has used malware to obtain a list of running processes on the system.^[127]

NavRAT uses tasklist /v to check running processes.^[30]

NETEAGLE can send process listings over the C2 channel.^[14]

OceanSalt can collect the name and ID for every process running on the system.^[26]

OilRig has run tasklist on a victim's machine.^[108]

Orz can gather a process list from the victim.^[20]

Pasam creates a backdoor through which remote attackers can retrieve lists of running processes.^[51]

PLAINTEE performs the tasklist command to list running processes.^[36]

PlugX has a module to list the processes running on a machine.^[15]

POORAIM can enumerate processes.^[16]

After compromising a victim, Poseidon Group lists all running processes.^[116]

PowerDuke has a command to list the victim's processes.^[18]

PowerSploit's Get-ProcessTokenPrivilege Privesc-PowerUp module can enumerate privileges for a given process.^[3][4]

PowerStallion has been used to monitor process lists.^[102]

POWRUNER may collect process information by running tasklist on a victim.^[25]

Proxysvc lists processes running on the system.^[39]

Pupy can list the running processes and get the process ID and parent process’s ID.^[1]

RATANKBA lists the system’s processes.^[46][47]

Remsec can obtain a process list from the victim.^[81]

RogueRobin checks the running processes for evidence it may be running in a sandbox environment. It specifically enumerates processes for Wireshark and Sysinternals.^[77]

ROKRAT lists the current running processes on the system.^[64]

RTM can obtain information about process integrity levels.^[9]

Seasalt has a command to perform a process listing.^[71]

SHOTPUT has a command to obtain a process listing.^[11]

Socksbot can list all running processes.^[88]

Stealth Falcon malware gathers a list of running processes.^[124]

StreamEx has the ability to enumerate processes.^[73]

Sykipot may gather a list of running processes by running tasklist /v.^[38]

SynAck enumerates all running processes.^[48][49]

Tasklist can be used to discover processes running on a system.^[5]

Trojan.Karagany can use tasklist to collect a list of running tasks.^[13]

Tropic Trooper enumerates the running processes on the system.^[123]

Turla surveys a system upon check-in to discover running processes using the tasklist /v command. Turla RPC backdoors have also enumerated processes associated with specific open ports or named pipes.^[69][102]

UBoatRAT can list running processes on the system.^[24]

Ursnif has gathered information about running processes.^[99][100]

VERMIN can get a list of the processes and running tasks on the system.^[59]

Volgmer can gather a list of processes.^[63]

WINERACK can enumerate processes.^[16]

WinMM sets a WH_CBT Windows hook to collect information on process creation.^[90]

Winnti Group looked for a specific process running on infected servers.^[113]

XAgentOSX contains the getProcessList function to run ps aux to get running processes.^[56]

yty gets an output of running processes using the tasklist command.^[76]

Zebrocy uses the tasklist and wmic process get Capture, ExecutablePath commands to gather the processes running on the system.^{[27][93][28][94][95]}

Zeus Panda checks for running processes on the victim’s machine.^[91]

ZxShell has a command, ps, to obtain a listing of processes on the system. ^[105]