Thanks to all of our ATT&CKcon participants. All sessions are here, and individual presentations will be posted soon.

Process Discovery

Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software running on systems within the network.

Windows

An example command that would obtain details on processes is "tasklist" using the Tasklist utility.

Mac and Linux

In Mac and Linux, this is accomplished with the ps command.

ID: T1057

Tactic: Discovery

Platform:  Linux, macOS, Windows

Permissions Required:  User, Administrator, SYSTEM

Data Sources:  Process monitoring, Process command-line parameters

CAPEC ID:  CAPEC-573

Version: 1.0

Examples

NameDescription
4H RAT

4H RAT has the capability to obtain a listing of running processes (including loaded modules).[1]

ADVSTORESHELL

ADVSTORESHELL can list running processes.[2]

APT28

An APT28 loader Trojan will enumerate the victim's processes searching for explorer.exe if its current process does not have necessary permissions.[3]

APT3

APT3 has a tool that can list out currently running processes.[4][5]

APT37

APT37's Freenki malware lists running processes using the Microsoft Windows API.[6]

Backdoor.Oldrea

Backdoor.Oldrea collects information about running processes.[7]

BACKSPACE

BACKSPACE may collect information about running processes.[8]

Bankshot

Bankshot identifies processes and collects the process ids.[9]

BBSRAT

BBSRAT can list running processes.[10]

Bisonal

Bisonal can obtain a list of running processes on the victim’s machine.[11]

BLACKCOFFEE

BLACKCOFFEE has the capability to discover processes.[12]

BlackEnergy

BlackEnergy has gathered a process list by using Tasklist.exe.[13][14]

Brave Prince

Brave Prince lists the running processes.[15]

Carbanak

Carbanak lists running processes.[16]

ChChes

ChChes collects its process identifier (PID) on the victim.[17]

Cobalt Strike

Cobalt Strike's "beacon" payload can collect information on process details.[18]

Comnie

Comnie uses the tasklist to view running processes on the victim’s machine.[19]

Crimson

Crimson contains a command to list processes.[20]

Deep Panda

Deep Panda uses the Microsoft Tasklist utility to list processes running on systems.[21]

Derusbi

Derusbi collects current and parent process IDs.[22][23]

Duqu

The discovery modules used with Duqu can collect information on process details.[24]

DustySky

DustySky collects information about running processes from victims.[25]

ELMER

ELMER is capable of performing process listings.[26]

FinFisher

FinFisher checks its parent process for indications that it is running in a sandbox setup.[27][28]

FruitFly

FruitFly has the ability to list processes on the system.[29]

GeminiDuke

GeminiDuke collects information on running processes and environment variables from the victim.[30]

gh0st

gh0st RAT is able to list processes.[31]

Gold Dragon

Gold Dragon checks the running processes on the victim’s machine.[15]

GravityRAT

GravityRAT lists the running processes on the system.[32]

HALFBAKED

HALFBAKED can obtain information about running processes on the victim.[33]

Helminth

Helminth has used Tasklist to get information on processes.[3]

Honeybee

Honeybee gathers a list of processes using the tasklist command and then is sent back to the control server.[34]

Hydraq

Hydraq creates a backdoor through which remote attackers can monitor processes.[35][36]

iKitten

iKitten lists the current processes running.[29]

InvisiMole

InvisiMole obtains a list of running processes.[37]

JHUHUGIT

JHUHUGIT obtains a list of running processes on the victim.[38][39]

JPIN

JPIN can list running processes.[40]

Kasidet

Kasidet has the ability to search for a given process name in processes currently running in the system.[41]

Kazuar

Kazuar obtains a list of running processes through WMI querying and the ps command.[42]

Ke3chang

Ke3chang performs process discovery using tasklist commands.[43][44]

KEYMARBLE

KEYMARBLE can obtain a list of running processes on the system.[45]

Komplex

The OsInfo function in Komplex collects a running process list.[46]

Kwampirs

Kwampirs collects a list of running services with the command tasklist /v.[47]

Lazarus Group

Several Lazarus Group malware families gather a list of running processes on a victim system and send it to their C2 server. A Destover-like variant used by Lazarus Group also gathers process times.[48][49][50][51]

Linfo

Linfo creates a backdoor through which remote attackers can retrieve a list of running processes.[52]

Magic Hound

Magic Hound malware can list running processes.[53]

MobileOrder

MobileOrder has a command to upload information about all running processes to its C2 server.[54]

Molerats

Molerats actors obtained a list of active processes on the victim and sent them to C2 servers.[25]

MoonWind

MoonWind has a command to return a list of running processes.[55]

Mosquito

Mosquito runs tasklist to obtain running processes.[56]

NavRAT

NavRAT uses tasklist /v to check running processes.[57]

NETEAGLE

NETEAGLE can send process listings over the C2 channel.[8]

OilRig

OilRig has run tasklist on a victim's machine.[58]

Orz

Orz can gather a process list from the victim.[59]

Pasam

Pasam creates a backdoor through which remote attackers can retrieve lists of running processes.[60]

PLAINTEE

PLAINTEE performs the tasklist command to list running processes.[61]

POORAIM

POORAIM can enumerate processes.[62]

Poseidon Group

After compromising a victim, Poseidon Group lists all running processes.[63]

PowerDuke

PowerDuke has a command to list the victim's processes.[64]

PowerSploit

PowerSploit's Get-ProcessTokenPrivilege Privesc-PowerUp module can enumerate privileges for a given process.[65][66]

POWRUNER

POWRUNER may collect process information by running tasklist on a victim.[67]

Proxysvc

Proxysvc lists processes running on the system.[51]

Pupy

Pupy can list the running processes and get the process ID and parent process’s ID.[68]

RATANKBA

RATANKBA lists the system’s processes.[69][70]

Remsec

Remsec can obtain a process list from the victim.[71]

RogueRobin

RogueRobin checks the running processes for evidence it may be running in a sandbox environment. It specifically enumerates processes for Wireshark and Sysinternals.[72]

ROKRAT

ROKRAT lists the current running processes on the system.[73]

RTM

RTM can obtain information about process integrity levels.[74]

SHOTPUT

SHOTPUT has a command to obtain a process listing.[75]

Socksbot

Socksbot can list all running processes.[76]

Stealth Falcon

Stealth Falcon malware gathers a list of running processes.[77]

StreamEx

StreamEx has the ability to enumerate processes.[78]

Sykipot

Sykipot may gather a list of running processes by running tasklist /v.[79]

SynAck

SynAck enumerates all running processes.[80][81]

Tasklist

Tasklist can be used to discover processes running on a system.[82]

Trojan.Karagany

Trojan.Karagany can use tasklist to collect a list of running tasks.[7]

Turla

Turla surveys a system upon check-in to discover running processes using the tasklist /v command.[83]

VERMIN

VERMIN can get a list of the processes and running tasks on the system.[84]

Volgmer

Volgmer can gather a list of processes.[85]

WINERACK

WINERACK can enumerate processes.[62]

WinMM

WinMM sets a WH_CBT Windows hook to collect information on process creation.[86]

Winnti Group

Winnti Group looked for a specific process running on infected servers.[87]

XAgentOSX

XAgentOSX contains the getProcessList function to run ps aux to get running processes.[88]

yty

yty gets an output of running processes using the tasklist command.[89]

Mitigation

Identify unnecessary system utilities or potentially malicious software that may be used to acquire information about processes, and audit and/or block them by using whitelisting [90] tools, like AppLocker, [91] [92] or Software Restriction Policies [93] where appropriate. [94]

Detection

System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as Lateral Movement, based on the information obtained.

Normal, benign system and network events that look like process discovery may be uncommon, depending on the environment and how they are used. Monitor processes and command-line arguments for actions that could be taken to gather system and network information. Remote access tools with built-in features may interact directly with the Windows API to gather information. Information may also be acquired through Windows system management tools such as Windows Management Instrumentation and PowerShell.

References

  1. Crowdstrike Global Intelligence Team. (2014, June 9). CrowdStrike Intelligence Report: Putter Panda. Retrieved January 22, 2016.
  2. ESET. (2016, October). En Route with Sednit - Part 2: Observing the Comings and Goings. Retrieved November 21, 2016.
  3. Unit 42. (2017, December 15). Unit 42 Playbook Viewer. Retrieved December 20, 2017.
  4. Chen, X., Scott, M., Caselden, D.. (2014, April 26). New Zero-Day Exploit targeting Internet Explorer Versions 9 through 11 Identified in Targeted Attacks. Retrieved January 14, 2016.
  5. Yates, M. (2017, June 18). APT3 Uncovered: The code evolution of Pirpi. Retrieved September 28, 2017.
  6. Mercer, W., Rascagneres, P. (2018, January 16). Korea In The Crosshairs. Retrieved May 21, 2018.
  7. Symantec Security Response. (2014, July 7). Dragonfly: Cyberespionage Attacks Against Energy Suppliers. Retrieved April 8, 2016.
  8. FireEye Labs. (2015, April). APT30 AND THE MECHANICS OF A LONG-RUNNING CYBER ESPIONAGE OPERATION. Retrieved May 1, 2015.
  9. Sherstobitoff, R. (2018, March 08). Hidden Cobra Targets Turkish Financial Sector With New Bankshot Implant. Retrieved May 18, 2018.
  10. Lee, B. Grunzweig, J. (2015, December 22). BBSRAT Attacks Targeting Russian Organizations Linked to Roaming Tiger. Retrieved August 19, 2016.
  11. Hayashi, K., Ray, V. (2018, July 31). Bisonal Malware Used in Attacks Against Russia and South Korea. Retrieved August 7, 2018.
  12. FireEye Labs/FireEye Threat Intelligence. (2015, May 14). Hiding in Plain Sight: FireEye and Microsoft Expose Obfuscation Tactic. Retrieved January 22, 2016.
  13. F-Secure Labs. (2014). BlackEnergy & Quedagh: The convergence of crimeware and APT attacks. Retrieved March 24, 2016.
  14. Baumgartner, K. and Garnaeva, M.. (2014, November 3). BE2 custom plugins, router abuse, and target profiles. Retrieved March 24, 2016.
  15. Sherstobitoff, R., Saavedra-Morales, J. (2018, February 02). Gold Dragon Widens Olympics Malware Attacks, Gains Permanent Presence on Victims’ Systems. Retrieved June 6, 2018.
  16. Bennett, J., Vengerik, B. (2017, June 12). Behind the CARBANAK Backdoor. Retrieved June 11, 2018.
  17. Miller-Osborn, J. and Grunzweig, J.. (2017, February 16). menuPass Returns with New Malware and New Attacks Against Japanese Academics and Organizations. Retrieved March 1, 2017.
  18. Strategic Cyber LLC. (2017, March 14). Cobalt Strike Manual. Retrieved May 24, 2017.
  19. Grunzweig, J. (2018, January 31). Comnie Continues to Target Organizations in East Asia. Retrieved June 7, 2018.
  20. Huss, D.. (2016, March 1). Operation Transparent Tribe. Retrieved June 8, 2016.
  21. Alperovitch, D. (2014, July 7). Deep in Thought: Chinese Targeting of National Security Think Tanks. Retrieved November 12, 2014.
  22. Fidelis Cybersecurity. (2016, February 29). The Turbo Campaign, Featuring Derusbi for 64-bit Linux. Retrieved March 2, 2016.
  23. FireEye. (2018, March 16). Suspected Chinese Cyber Espionage Group (TEMP.Periscope) Targeting U.S. Engineering and Maritime Industries. Retrieved April 11, 2018.
  24. Symantec Security Response. (2011, November). W32.Duqu: The precursor to the next Stuxnet. Retrieved September 17, 2015.
  25. ClearSky. (2016, January 7). Operation DustySky. Retrieved January 8, 2016.
  26. Winters, R.. (2015, December 20). The EPS Awakens - Part 2. Retrieved January 22, 2016.
  27. FinFisher. (n.d.). Retrieved December 20, 2017.
  28. Allievi, A.,Flori, E. (2018, March 01). FinFisher exposed: A researcher’s tale of defeating traps, tricks, and complex virtual machines. Retrieved July 9, 2018.
  29. Patrick Wardle. (n.d.). Mac Malware of 2017. Retrieved September 21, 2018.
  30. F-Secure Labs. (2015, September 17). The Dukes: 7 years of Russian cyberespionage. Retrieved December 10, 2015.
  31. FireEye Threat Intelligence. (2015, July 13). Demonstrating Hustle, Chinese APT Groups Quickly Use Zero-Day Vulnerability (CVE-2015-5119) Following Hacking Team Leak. Retrieved January 25, 2016.
  32. Mercer, W., Rascagneres, P. (2018, April 26). GravityRAT - The Two-Year Evolution Of An APT Targeting India. Retrieved May 16, 2018.
  33. Carr, N., et al. (2017, April 24). FIN7 Evolution and the Phishing LNK. Retrieved April 24, 2017.
  34. Sherstobitoff, R. (2018, March 02). McAfee Uncovers Operation Honeybee, a Malicious Document Campaign Targeting Humanitarian Aid Groups. Retrieved May 16, 2018.
  35. Symantec Security Response. (2010, January 18). The Trojan.Hydraq Incident. Retrieved February 20, 2018.
  36. Lelli, A. (2010, January 11). Trojan.Hydraq. Retrieved February 20, 2018.
  37. Hromcová, Z. (2018, June 07). InvisiMole: Surprisingly equipped spyware, undercover since 2013. Retrieved July 10, 2018.
  38. ESET. (2016, October). En Route with Sednit - Part 1: Approaching the Target. Retrieved November 8, 2016.
  39. Lee, B, et al. (2018, February 28). Sofacy Attacks Multiple Government Entities. Retrieved March 15, 2018.
  40. Windows Defender Advanced Threat Hunting Team. (2016, April 29). PLATINUM: Targeted attacks in South and Southeast Asia. Retrieved February 15, 2018.
  41. Yadav, A., et al. (2016, January 29). Malicious Office files dropping Kasidet and Dridex. Retrieved March 24, 2016.
  42. Levene, B, et al. (2017, May 03). Kazuar: Multiplatform Espionage Backdoor with API Access. Retrieved July 17, 2018.
  43. Villeneuve, N., Bennett, J. T., Moran, N., Haq, T., Scott, M., & Geers, K. (2014). OPERATION “KE3CHANG”: Targeted Attacks Against Ministries of Foreign Affairs. Retrieved November 12, 2014.
  44. Smallridge, R. (2018, March 10). APT15 is alive and strong: An analysis of RoyalCli and RoyalDNS. Retrieved April 4, 2018.
  45. US-CERT. (2018, August 09). MAR-10135536-17 – North Korean Trojan: KEYMARBLE. Retrieved August 16, 2018.
  46. Dani Creus, Tyler Halfpop, Robert Falcone. (2016, September 26). Sofacy's 'Komplex' OS X Trojan. Retrieved July 8, 2017.
  47. Symantec Security Response Attack Investigation Team. (2018, April 23). New Orangeworm attack group targets the healthcare sector in the U.S., Europe, and Asia. Retrieved May 8, 2018.
  1. Novetta Threat Research Group. (2016, February 24). Operation Blockbuster: Unraveling the Long Thread of the Sony Attack. Retrieved February 25, 2016.
  2. Novetta Threat Research Group. (2016, February 24). Operation Blockbuster: Loaders, Installers and Uninstallers Report. Retrieved March 2, 2016.
  3. Sherstobitoff, R. (2018, February 12). Lazarus Resurfaces, Targets Global Banks and Bitcoin Users. Retrieved February 19, 2018.
  4. Sherstobitoff, R., Malhotra, A. (2018, April 24). Analyzing Operation GhostSecret: Attack Seeks to Steal Data Worldwide. Retrieved May 16, 2018.
  5. Zhou, R. (2012, May 15). Backdoor.Linfo. Retrieved February 23, 2018.
  6. Lee, B. and Falcone, R. (2017, February 15). Magic Hound Campaign Attacks Saudi Targets. Retrieved December 27, 2017.
  7. Falcone, R. and Miller-Osborn, J.. (2016, January 24). Scarlet Mimic: Years-Long Espionage Campaign Targets Minority Activists. Retrieved February 10, 2016.
  8. Miller-Osborn, J. and Grunzweig, J.. (2017, March 30). Trochilus and New MoonWind RATs Used In Attack Against Thai Organizations. Retrieved March 30, 2017.
  9. ESET, et al. (2018, January). Diplomats in Eastern Europe bitten by a Turla mosquito. Retrieved July 3, 2018.
  10. Mercer, W., Rascagneres, P. (2018, May 31). NavRAT Uses US-North Korea Summit As Decoy For Attacks In South Korea. Retrieved June 11, 2018.
  11. Falcone, R. and Lee, B.. (2016, May 26). The OilRig Campaign: Attacks on Saudi Arabian Organizations Deliver Helminth Backdoor. Retrieved May 3, 2017.
  12. Axel F, Pierre T. (2017, October 16). Leviathan: Espionage actor spearphishes maritime and defense targets. Retrieved February 15, 2018.
  13. Mullaney, C. & Honda, H. (2012, May 4). Trojan.Pasam. Retrieved February 22, 2018.
  14. Ash, B., et al. (2018, June 26). RANCOR: Targeted Attacks in South East Asia Using PLAINTEE and DDKONG Malware Families. Retrieved July 2, 2018.
  15. FireEye. (2018, February 20). APT37 (Reaper): The Overlooked North Korean Actor. Retrieved March 1, 2018.
  16. Kaspersky Lab's Global Research and Analysis Team. (2016, February 9). Poseidon Group: a Targeted Attack Boutique specializing in global cyber-espionage. Retrieved March 16, 2016.
  17. Adair, S.. (2016, November 9). PowerDuke: Widespread Post-Election Spear Phishing Campaigns Targeting Think Tanks and NGOs. Retrieved January 11, 2017.
  18. PowerShellMafia. (2012, May 26). PowerSploit - A PowerShell Post-Exploitation Framework. Retrieved February 6, 2018.
  19. PowerSploit. (n.d.). PowerSploit. Retrieved February 6, 2018.
  20. Sardiwal, M, et al. (2017, December 7). New Targeted Attack in the Middle East by APT34, a Suspected Iranian Threat Group, Using CVE-2017-11882 Exploit. Retrieved December 20, 2017.
  21. Nicolas Verdier. (n.d.). Retrieved January 29, 2018.
  22. Lei, C., et al. (2018, January 24). Lazarus Campaign Targeting Cryptocurrencies Reveals Remote Controller Tool, an Evolved RATANKBA, and More. Retrieved May 22, 2018.
  23. Trend Micro. (2017, February 27). RATANKBA: Delving into Large-scale Watering Holes against Enterprises. Retrieved May 22, 2018.
  24. Kaspersky Lab's Global Research & Analysis Team. (2016, August 9). The ProjectSauron APT. Technical Analysis. Retrieved August 17, 2016.
  25. Falcone, R., et al. (2018, July 27). New Threat Actor Group DarkHydrus Targets Middle East Government. Retrieved August 2, 2018.
  26. Mercer, W., Rascagneres, P. (2017, April 03). Introducing ROKRAT. Retrieved May 21, 2018.
  27. Faou, M. and Boutin, J.. (2017, February). Read The Manual: A Guide to the RTM Banking Trojan. Retrieved March 9, 2017.
  28. Falcone, R. and Wartell, R.. (2015, July 27). Observations on CVE-2015-3113, Prior Zero-Days and the Pirpi Payload. Retrieved January 22, 2016.
  29. Lunghi, D., et al. (2017, December). Untangling the Patchwork Cyberespionage Group. Retrieved July 10, 2018.
  30. Marczak, B. and Scott-Railton, J.. (2016, May 29). Keep Calm and (Don’t) Enable Macros: A New Threat Actor Targets UAE Dissidents. Retrieved June 8, 2016.
  31. Cylance SPEAR Team. (2017, February 9). Shell Crew Variants Continue to Fly Under Big AV’s Radar. Retrieved February 15, 2017.
  32. Blasco, J. (2011, December 12). Another Sykipot sample likely targeting US federal agencies. Retrieved March 28, 2016.
  33. Ivanov, A. et al.. (2018, May 7). SynAck targeted ransomware uses the Doppelgänging technique. Retrieved May 22, 2018.
  34. Bettencourt, J. (2018, May 7). Kaspersky Lab finds new variant of SynAck ransomware using sophisticated Doppelgänging technique. Retrieved May 24, 2018.
  35. Microsoft. (n.d.). Tasklist. Retrieved December 23, 2015.
  36. Kaspersky Lab's Global Research and Analysis Team. (2014, August 7). The Epic Turla Operation: Solving some of the mysteries of Snake/Uroburos. Retrieved December 11, 2014.
  37. Lancaster, T., Cortes, J. (2018, January 29). VERMIN: Quasar RAT and Custom Malware Used In Ukraine. Retrieved July 5, 2018.
  38. Yagi, J. (2014, August 24). Trojan.Volgmer. Retrieved July 16, 2018.
  39. Baumgartner, K., Golovkin, M.. (2015, May). The MsnMM Campaigns: The Earliest Naikon APT Campaigns. Retrieved December 17, 2015.
  40. Kaspersky Lab's Global Research and Analysis Team. (2013, April 11). Winnti. More than just a game. Retrieved February 8, 2017.
  41. Robert Falcone. (2017, February 14). XAgentOSX: Sofacy's Xagent macOS Tool. Retrieved July 12, 2017.
  42. Schwarz, D., Sopko J. (2018, March 08). Donot Team Leverages New Modular Malware Framework in South Asia. Retrieved June 11, 2018.
  43. Beechey, J. (2010, December). Application Whitelisting: Panacea or Propaganda?. Retrieved November 18, 2014.
  44. Tomonaga, S. (2016, January 26). Windows Commands Abused by Attackers. Retrieved February 2, 2016.
  45. NSA Information Assurance Directorate. (2014, August). Application Whitelisting Using Microsoft AppLocker. Retrieved March 31, 2016.
  46. Corio, C., & Sayana, D. P. (2008, June). Application Lockdown with Software Restriction Policies. Retrieved November 18, 2014.
  47. Microsoft. (2012, June 27). Using Software Restriction Policies and AppLocker Policies. Retrieved April 7, 2016.