Process Discovery

Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.

In Windows environments, adversaries could obtain details on running processes using the Tasklist utility via cmd or Get-Process via PowerShell. Information about processes can also be extracted from the output of Native API calls such as CreateToolhelp32Snapshot. In Mac and Linux, this is accomplished with the ps command. Adversaries may also opt to enumerate processes via /proc.

ID: T1057

Sub-techniques: No sub-techniques

Tactic: Discovery

Platforms: Linux, Windows, macOS

System Requirements: Administrator, SYSTEM may provide better process ownership details

Permissions Required: Administrator, SYSTEM, User

Data Sources: API monitoring, Process command-line parameters, Process monitoring

CAPEC ID: CAPEC-573

Version: 1.2

Created: 31 May 2017

Last Modified: 26 March 2020

Version Permalink

Live Version

Procedure Examples

Name	Description
4H RAT	4H RAT has the capability to obtain a listing of running processes (including loaded modules).^[1]
ADVSTORESHELL	ADVSTORESHELL can list running processes.^[2]
Agent Tesla	Agent Tesla can list the current running processes on the system.^[3]
APT1	APT1 gathered a list of running processes on the system using `tasklist /v`.^[4]
APT28	An APT28 loader Trojan will enumerate the victim's processes searching for explorer.exe if its current process does not have necessary permissions.^[5]
APT3	APT3 has a tool that can list out currently running processes.^[6]^[7]
APT37	APT37's Freenki malware lists running processes using the Microsoft Windows API.^[8]
APT38	APT38 leveraged Sysmon to understand the processes, services in the organization.^[9]
Aria-body	Aria-body has the ability to enumerate loaded modules for a process.^[10].
Astaroth	Astaroth searches for different processes on the system. ^[11]
Avenger	Avenger has the ability to use Tasklist to identify running processes.^[12]
Azorult	Azorult can collect a list of running processes by calling CreateToolhelp32Snapshot.^[13]^[14]
BabyShark	BabyShark has executed the `tasklist` command.^[15]
Backdoor.Oldrea	Backdoor.Oldrea collects information about running processes.^[16]
BACKSPACE	BACKSPACE may collect information about running processes.^[17]
Bankshot	Bankshot identifies processes and collects the process ids.^[18]
BBSRAT	BBSRAT can list running processes.^[19]
BISCUIT	BISCUIT has a command to enumerate running processes and identify their owners.^[20]
Bisonal	Bisonal can obtain a list of running processes on the victim’s machine.^[21]
BLACKCOFFEE	BLACKCOFFEE has the capability to discover processes.^[22]
BlackEnergy	BlackEnergy has gathered a process list by using Tasklist.exe.^[23]^[24]^[25]
Bonadan	Bonadan can use the `ps` command to discover other cryptocurrency miners active on the system.^[26]
Brave Prince	Brave Prince lists the running processes.^[27]
Bundlore	Bundlore has used the `ps` command to list processes.^[28]
Cannon	Cannon can obtain a list of processes running on the system.^[29]^[30]
Carbanak	Carbanak lists running processes.^[31]
Carberp	Carberp has collected a list of running processes.^[32]
Carbon	Carbon can list the processes on the victim’s machine.^[33]
Cardinal RAT	Cardinal RAT contains watchdog functionality that ensures its process is always running, else spawns a new instance.^[34]
ChChes	ChChes collects its process identifier (PID) on the victim.^[35]
Cobalt Strike	Cobalt Strike's "beacon" payload can collect information on process details.^[36]
Comnie	Comnie uses the `tasklist` to view running processes on the victim’s machine.^[37]
Crimson	Crimson contains a command to list processes.^[38]
Dacls	Dacls can collect data on running and parent processes.^[39]
DarkComet	DarkComet can list active processes running on the victim’s machine.^[40]
Darkhotel	Darkhotel has searched for anti-malware strings and anti-virus processes running on the system.^[41]
Deep Panda	Deep Panda uses the Microsoft Tasklist utility to list processes running on systems.^[42]
Derusbi	Derusbi collects current and parent process IDs.^[43]^[44]
down_new	down_new has the ability to list running processes on a compromised host.^[12]
Duqu	The discovery modules used with Duqu can collect information on process details.^[45]
DustySky	DustySky collects information about running processes from victims.^[46]^[47]
Elise	Elise enumerates processes via the `tasklist` command.^[48]
ELMER	ELMER is capable of performing process listings.^[49]
Emotet	Emotet has been observed enumerating local processes.^[50]
Empire	Empire can find information about processes running on local and remote systems.^[51]
Epic	Epic uses the `tasklist /v` command to obtain a list of processes.^[52]^[53]
EvilBunny	EvilBunny has used EnumProcesses() to identify how many process are running in the environment.^[54]
FatDuke	FatDuke can list running processes on the localhost.^[55]
FELIXROOT	FELIXROOT collects a list of running processes.^[56]
Final1stspy	Final1stspy obtains a list of running processes.^[57]
FinFisher	FinFisher checks its parent process for indications that it is running in a sandbox setup.^[58]^[59]
FrameworkPOS	FrameworkPOS can enumerate and exclude selected processes on a compromised host to speed execution of memory scraping.^[60]
Frankenstein	Frankenstein has enumerated hosts, looking to obtain a list of all currently running processes.^[61]
FruitFly	FruitFly has the ability to list processes on the system.^[62]
Fysbis	Fysbis can collect information about running processes.^[63]
GeminiDuke	GeminiDuke collects information on running processes and environment variables from the victim.^[64]
Get2	Get2 has the ability to identify running processes on an infected host.^[65]
gh0st RAT	gh0st RAT has the capability to list processes.^[66]
Gold Dragon	Gold Dragon checks the running processes on the victim’s machine.^[27]
Goopy	Goopy has checked for the Google Updater process to ensure Goopy was loaded properly.^[67]
GravityRAT	GravityRAT lists the running processes on the system.^[68]
HALFBAKED	HALFBAKED can obtain information about running processes on the victim.^[69]
Helminth	Helminth has used Tasklist to get information on processes.^[5]
Honeybee	Honeybee gathers a list of processes using the `tasklist` command and then is sent back to the control server.^[70]
HotCroissant	HotCroissant has the ability to list running processes on the infected host.^[71]
Hydraq	Hydraq creates a backdoor through which remote attackers can monitor processes.^[72]^[73]
iKitten	iKitten lists the current processes running.^[62]
Imminent Monitor	Imminent Monitor has a "Process Watcher" feature to monitor processes in case the client ever crashes or gets closed.^[74]
Inception	Inception has used a reconnaissance module to identify active processes and other associated loaded modules.^[75]
InvisiMole	InvisiMole can obtain a list of running processes.^[76]^[77]
Ixeshe	Ixeshe can list running processes.^[78]
JHUHUGIT	JHUHUGIT obtains a list of running processes on the victim.^[79]^[80]
JPIN	JPIN can list running processes.^[81]
jRAT	jRAT can query and kill system processes.^[82]
Kasidet	Kasidet has the ability to search for a given process name in processes currently running in the system.^[83]
Kazuar	Kazuar obtains a list of running processes through WMI querying and the `ps` command.^[84]
Ke3chang	Ke3chang performs process discovery using `tasklist` commands.^[85]^[86]
KEYMARBLE	KEYMARBLE can obtain a list of running processes on the system.^[87]
Komplex	The OsInfo function in Komplex collects a running process list.^[88]
KONNI	KONNI has used tasklist.exe to get a snapshot of the current processes’ state of the target machine.^[89]
Kwampirs	Kwampirs collects a list of running services with the command `tasklist /v`.^[90]
Lazarus Group	Several Lazarus Group malware families gather a list of running processes on a victim system and send it to their C2 server. A Destover-like variant used by Lazarus Group also gathers process times.^[91]^[92]^[93]^[94]^[39]
Linfo	Linfo creates a backdoor through which remote attackers can retrieve a list of running processes.^[95]
LoudMiner	LoudMiner used the `ps` command to monitor the running processes on the system.^[96]
Machete	Machete has a component to check for running processes to look for web browsers.^[97]
Magic Hound	Magic Hound malware can list running processes.^[98]
Maze	Maze has gathered all of the running system processes.^[99]
Metamorfo	Metamorfo has performed process name checks and has monitored applications.^[100]
MobileOrder	MobileOrder has a command to upload information about all running processes to its C2 server.^[101]
Molerats	Molerats actors obtained a list of active processes on the victim and sent them to C2 servers.^[46]
MoonWind	MoonWind has a command to return a list of running processes.^[102]
Mosquito	Mosquito runs `tasklist` to obtain running processes.^[103]
MuddyWater	MuddyWater has used malware to obtain a list of running processes on the system.^[104]^[105]
NavRAT	NavRAT uses `tasklist /v` to check running processes.^[106]
NETEAGLE	NETEAGLE can send process listings over the C2 channel.^[17]
njRAT	njRAT can search a list of running processes for Tr.exe.^[107]
OceanSalt	OceanSalt can collect the name and ID for every process running on the system.^[108]
OilRig	OilRig has run `tasklist` on a victim's machine.^[109]
Orz	Orz can gather a process list from the victim.^[110]
Pasam	Pasam creates a backdoor through which remote attackers can retrieve lists of running processes.^[111]
Pillowmint	Pillowmint can iterate through running processes every six seconds collecting a list of processes to capture from later.^[112]
PipeMon	PipeMon can iterate over the running processes to find a suitable injection target.^[113]
PLAINTEE	PLAINTEE performs the `tasklist` command to list running processes.^[114]
PLEAD	PLEAD has the ability to list processes on the compromised host.^[115]
PlugX	PlugX has a module to list the processes running on a machine.^[116]
PoetRAT	PoetRAT has the ability to list all running processes.^[117]
POORAIM	POORAIM can enumerate processes.^[118]
Poseidon Group	After compromising a victim, Poseidon Group lists all running processes.^[119]
PowerDuke	PowerDuke has a command to list the victim's processes.^[120]
PowerShower	PowerShower has the ability to deploy a reconnaissance module to retrieve a list of the active processes.^[121]
PowerSploit	PowerSploit's `Get-ProcessTokenPrivilege` Privesc-PowerUp module can enumerate privileges for a given process.^[122]^[123]
PowerStallion	PowerStallion has been used to monitor process lists.^[124]
POWERSTATS	POWERSTATS has used `get_tasklist` to discover processes on the compromised host.^[125]
POWRUNER	POWRUNER may collect process information by running `tasklist` on a victim.^[126]
Proxysvc	Proxysvc lists processes running on the system.^[94]
Pupy	Pupy can list the running processes and get the process ID and parent process’s ID.^[127]
RATANKBA	RATANKBA lists the system’s processes.^[128]^[129]
Remsec	Remsec can obtain a process list from the victim.^[130]
Rising Sun	Rising Sun can enumerate all running processes and process information on an infected machine.^[131]
Rocke	Rocke can detect a running process's PID on the infected machine.^[132]
RogueRobin	RogueRobin checks the running processes for evidence it may be running in a sandbox environment. It specifically enumerates processes for Wireshark and Sysinternals.^[133]
ROKRAT	ROKRAT lists the current running processes on the system.^[134]^[135]
RTM	RTM can obtain information about process integrity levels.^[136]
Ryuk	Ryuk has called `CreateToolhelp32Snapshot` to enumerate all running processes.^[137]
Seasalt	Seasalt has a command to perform a process listing.^[20]
ShimRatReporter	ShimRatReporter listed all running processes on the machine.^[138]
SHOTPUT	SHOTPUT has a command to obtain a process listing.^[139]
Skidmap	Skidmap has monitored critical processes to ensure resiliency.^[140]
Socksbot	Socksbot can list all running processes.^[141]
SoreFang	SoreFang can enumerate processes on a victim machine through use of Tasklist.^[142]
Stealth Falcon	Stealth Falcon malware gathers a list of running processes.^[143]
StreamEx	StreamEx has the ability to enumerate processes.^[144]
StrongPity	StrongPity can determine if a user is logged in by checking to see if explorer.exe is running.^[145]
Sunburst	Sunburst collected a list of process names that were hashed using a FNV-1a + XOR algorithm to check against similarly-hashed hardcoded blocklists.^[146]
Sunspot	Sunspot monitored running processes for instances of `MsBuild.exe` by hashing the name of each running process and comparing it to the corresponding value `0x53D525`. It also extracted command-line arguments and individual arguments from the running `MsBuild.exe` process to identify the directory path of the Orion software Visual Studio solution.^[147]
Sykipot	Sykipot may gather a list of running processes by running `tasklist /v`.^[148]
SynAck	SynAck enumerates all running processes.^[149]^[150]
SYSCON	SYSCON has the ability to use Tasklist to list running processes.^[151]
TajMahal	TajMahal has the ability to identify running processes and associated plugins on an infected host.^[152]
Tasklist	Tasklist can be used to discover processes running on a system.^[153]
Trojan.Karagany	Trojan.Karagany can use Tasklist to collect a list of running tasks.^[16]^[154]
Tropic Trooper	Tropic Trooper is capable of enumerating the running processes on the system using `pslist`.^[155]^[156]
TSCookie	TSCookie has the ability to list processes on the infected host.^[157]
Turla	Turla surveys a system upon check-in to discover running processes using the `tasklist /v` command.^[52] Turla RPC backdoors have also enumerated processes associated with specific open ports or named pipes.^[124]
UBoatRAT	UBoatRAT can list running processes on the system.^[158]
UNC2452	UNC2452 used multiple command-line utilities to enumerate running processes.^[159]^[160]
Ursnif	Ursnif has gathered information about running processes.^[161]^[162]
USBferry	USBferry can use `tasklist` to gather information about the process running on the infected system.^[156]
Valak	Valak has the ability to enumerate running processes on a compromised host.^[163]
VERMIN	VERMIN can get a list of the processes and running tasks on the system.^[164]
Volgmer	Volgmer can gather a list of processes.^[165]
WINERACK	WINERACK can enumerate processes.^[118]
WinMM	WinMM sets a WH_CBT Windows hook to collect information on process creation.^[166]
Winnti Group	Winnti Group looked for a specific process running on infected servers.^[167]
XAgentOSX	XAgentOSX contains the getProcessList function to run `ps aux` to get running processes.^[168]
yty	yty gets an output of running processes using the `tasklist` command.^[169]
Zebrocy	Zebrocy uses the `tasklist` and `wmic process get Capture, ExecutablePath` commands to gather the processes running on the system.^[29]^[170]^[30]^[171]^[172]
Zeus Panda	Zeus Panda checks for running processes on the victim’s machine.^[173]
ZxShell	ZxShell has a command, ps, to obtain a listing of processes on the system.^[174]

Mitigations

This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features.

Detection

System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as Lateral Movement, based on the information obtained.

Normal, benign system and network events that look like process discovery may be uncommon, depending on the environment and how they are used. Monitor processes and command-line arguments for actions that could be taken to gather system and network information. Remote access tools with built-in features may interact directly with the Windows API to gather information. Information may also be acquired through Windows system management tools such as Windows Management Instrumentation and PowerShell.

Process Discovery

Procedure Examples

Mitigations

Detection

References