Process Discovery

4H RAT has the capability to obtain a listing of running processes (including loaded modules).^[1]

ADVSTORESHELL can list running processes.^[2]

Agent Tesla lists the current running processes on the system.^[3]

APT1 gathered a list of running processes on the system using tasklist /v.^[4]

An APT28 loader Trojan will enumerate the victim's processes searching for explorer.exe if its current process does not have necessary permissions.^[5]

APT3 has a tool that can list out currently running processes.^[6][7]

APT37's Freenki malware lists running processes using the Microsoft Windows API.^[8]

APT38 leveraged Sysmon to understand the processes, services in the organization.^[9]

Astaroth searches for different processes on the system.^[10]

Azorult can collect a list of running processes by calling CreateToolhelp32Snapshot.^[11][12]

Backdoor.Oldrea collects information about running processes.^[13]

BACKSPACE may collect information about running processes.^[14]

Bankshot identifies processes and collects the process ids.^[15]

BBSRAT can list running processes.^[16]

BISCUIT has a command to enumerate running processes and identify their owners.^[17]

Bisonal can obtain a list of running processes on the victim’s machine.^[18]

BLACKCOFFEE has the capability to discover processes.^[19]

BlackEnergy has gathered a process list by using Tasklist.exe.^[20][21]

Brave Prince lists the running processes.^[22]

Cannon can obtain a list of processes running on the system.^[23][24]

Carbanak lists running processes.^[25]

Carbon can list the processes on the victim’s machine.^[26]

Cardinal RAT contains watchdog functionality that ensures its process is always running, else spawns a new instance.^[27]

ChChes collects its process identifier (PID) on the victim.^[28]

Cobalt Strike's "beacon" payload can collect information on process details.^[29]

Comnie uses the tasklist to view running processes on the victim’s machine.^[30]

Crimson contains a command to list processes.^[31]

DarkComet can list active processes running on the victim’s machine.^[32]

Darkhotel has searched for anti-malware strings and anti-virus processes running on the system.^[33]

Deep Panda uses the Microsoft Tasklist utility to list processes running on systems.^[34]

Derusbi collects current and parent process IDs.^[35][36]

The discovery modules used with Duqu can collect information on process details.^[37]

DustySky collects information about running processes from victims.^[38]

Elise enumerates processes via the tasklist command.^[39]

ELMER is capable of performing process listings.^[40]

Emotet has been observed enumerating local processes.^[41]

Empire can find information about processes running on local and remote systems.^[42]

Epic uses the tasklist /v command to obtain a list of processes.^[43][44]

FELIXROOT collects a list of running processes.^[45]

Final1stspy obtains a list of running processes.^[46]

FinFisher checks its parent process for indications that it is running in a sandbox setup.^[47][48]

FruitFly has the ability to list processes on the system.^[49]

GeminiDuke collects information on running processes and environment variables from the victim.^[50]

gh0st RAT has the capability to list processes.^[51]

Gold Dragon checks the running processes on the victim’s machine.^[22]

GravityRAT lists the running processes on the system.^[52]

HALFBAKED can obtain information about running processes on the victim.^[53]

Helminth has used Tasklist to get information on processes.^[5]

Honeybee gathers a list of processes using the tasklist command and then is sent back to the control server.^[54]

Hydraq creates a backdoor through which remote attackers can monitor processes.^[55][56]

iKitten lists the current processes running.^[49]

InvisiMole obtains a list of running processes.^[57]

JHUHUGIT obtains a list of running processes on the victim.^[58][59]

JPIN can list running processes.^[60]

jRAT can query and kill system processes.^[61]

Kasidet has the ability to search for a given process name in processes currently running in the system.^[62]

Kazuar obtains a list of running processes through WMI querying and the ps command.^[63]

Ke3chang performs process discovery using tasklist commands.^[64][65]

KEYMARBLE can obtain a list of running processes on the system.^[66]

The OsInfo function in Komplex collects a running process list.^[67]

Kwampirs collects a list of running services with the command tasklist /v.^[68]

Several Lazarus Group malware families gather a list of running processes on a victim system and send it to their C2 server. A Destover-like variant used by Lazarus Group also gathers process times.^{[69][70][71][72]}

Linfo creates a backdoor through which remote attackers can retrieve a list of running processes.^[73]

Magic Hound malware can list running processes.^[74]

MobileOrder has a command to upload information about all running processes to its C2 server.^[75]

Molerats actors obtained a list of active processes on the victim and sent them to C2 servers.^[38]

MoonWind has a command to return a list of running processes.^[76]

Mosquito runs tasklist to obtain running processes.^[77]

MuddyWater has used malware to obtain a list of running processes on the system.^[78]

NavRAT uses tasklist /v to check running processes.^[79]

NETEAGLE can send process listings over the C2 channel.^[14]

OceanSalt can collect the name and ID for every process running on the system.^[80]

OilRig has run tasklist on a victim's machine.^[81]

Orz can gather a process list from the victim.^[82]

Pasam creates a backdoor through which remote attackers can retrieve lists of running processes.^[83]

PLAINTEE performs the tasklist command to list running processes.^[84]

PlugX has a module to list the processes running on a machine.^[85]

POORAIM can enumerate processes.^[86]

After compromising a victim, Poseidon Group lists all running processes.^[87]

PowerDuke has a command to list the victim's processes.^[88]

PowerSploit's Get-ProcessTokenPrivilege Privesc-PowerUp module can enumerate privileges for a given process.^[89][90]

POWRUNER may collect process information by running tasklist on a victim.^[91]

Proxysvc lists processes running on the system.^[72]

Pupy can list the running processes and get the process ID and parent process’s ID.^[92]

RATANKBA lists the system’s processes.^[93][94]

Remsec can obtain a process list from the victim.^[95]

RogueRobin checks the running processes for evidence it may be running in a sandbox environment. It specifically enumerates processes for Wireshark and Sysinternals.^[96]

ROKRAT lists the current running processes on the system.^[97]

RTM can obtain information about process integrity levels.^[98]

Seasalt has a command to perform a process listing.^[17]

SHOTPUT has a command to obtain a process listing.^[99]

Socksbot can list all running processes.^[100]

Stealth Falcon malware gathers a list of running processes.^[101]

StreamEx has the ability to enumerate processes.^[102]

Sykipot may gather a list of running processes by running tasklist /v.^[103]

SynAck enumerates all running processes.^[104][105]

Tasklist can be used to discover processes running on a system.^[106]

Trojan.Karagany can use tasklist to collect a list of running tasks.^[13]

Tropic Trooper enumerates the running processes on the system.^[107]

Turla surveys a system upon check-in to discover running processes using the tasklist /v command.^[43]

UBoatRAT can list running processes on the system.^[108]

VERMIN can get a list of the processes and running tasks on the system.^[109]

Volgmer can gather a list of processes.^[110]

WINERACK can enumerate processes.^[86]

WinMM sets a WH_CBT Windows hook to collect information on process creation.

Winnti Group looked for a specific process running on infected servers.^[111]

XAgentOSX contains the getProcessList function to run ps aux to get running processes.^[112]

yty gets an output of running processes using the tasklist command.^[113]

Zebrocy uses the tasklist command to gather the processes running on the system.^{[23][114][24]}

Zeus Panda checks for running processes on the victim’s machine.^[115]