Adversaries may attempt to get information about running processes on a device. Information obtained could be used to gain an understanding of common software/applications running on devices within a network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Recent Android security enhancements have made it more difficult to obtain a list of running processes. On Android 7 and later, there is no way for an application to obtain the process list without abusing elevated privileges. This is due to the Android kernel utilizing the hidepid mount feature. Prior to Android 7, applications could utilize the ps command or examine the /proc directory on the device.[1]
In iOS, applications have previously been able to use the sysctl command to obtain a list of running processes. This functionality has been removed in later iOS versions.
| ID | Name | Description |
|---|---|---|
| S0440 | Agent Smith |
Agent Smith checks if a targeted application is running in user-space prior to infection.[2] |
| S0422 | Anubis | |
| S1215 | Binary Validator |
Binary Validator has obtained a list of running processes.[4] |
| S1225 | CherryBlos |
CherryBlos has used the Accessibility Service to monitor when a wallet application has launched.[5] |
| S0421 | GolfSpy | |
| S0544 | HenBox | |
| S1185 | LightSpy | |
| C0054 | Operation Triangulation |
During Operation Triangulation, the threat actors have obtained a list of processes.[10] |
| S0411 | Rotexy | |
| S1055 | SharkBot |
SharkBot can use Accessibility Services to detect which process is in the foreground.[12] |
| S1216 | TriangleDB |
TriangleDB has collected a list of running processes.[10] |
| S0489 | WolfRAT |
WolfRAT uses |
| S0311 | YiSpecter |
YiSpecter has collected information about running processes.[14] |
| ID | Mitigation | Description |
|---|---|---|
| M1002 | Attestation |
Attestation can typically detect rooted devices. For MDM-enrolled devices, action can be taken if a device fails an attestation check. |
| M1006 | Use Recent OS Version |
Android 7 and later iOS versions introduced changes that prevent applications from performing Process Discovery without elevated privileges. |
| ID | Name | Analytic ID | Analytic Description |
|---|---|---|---|
| DET0692 | Detection of Process Discovery | AN1804 |
Defender observes an app/package attempting to enumerate running processes by triggering restricted process visibility mechanisms (e.g., repeated queries for running tasks/services, rapid iteration over process identifiers, or access attempts against /proc entries) that are atypical for its declared function and occur without an associated user-facing diagnostic workflow. The detection relies on correlating (1) OS/API calls or shell/system utility execution indicative of process listing or /proc traversal, (2) app privilege context (root, debug build, device owner/profile owner, accessibility/IME status), (3) background execution state, and (4) optional follow-on behaviors consistent with automated discovery (short bursts of local IPC probes, network beacons immediately after enumeration, or rapid targeting of specific high-value package/process names). The analytic should describe what is observable: repeated enumeration signals + privilege context + timing relationship, not the adversary’s intent. |
| AN1805 |
Defender observes signals consistent with attempted process listing on iOS where modern OS protections generally prevent broad process enumeration for non-root apps. Detections therefore focus on: (1) feasibility gating via integrity/jailbreak posture, and (2) observable security/log anomalies consistent with attempts to query process tables or restricted system interfaces (e.g., repeated sandbox denials, suspicious sysctl-like access attempts, or abnormal use of private frameworks). Correlate integrity compromise indicators with repeated restricted-access events and optional follow-on behaviors (rapid targeting of specific bundles/services or immediate network beacons) to raise confidence that process discovery is occurring. |