The Tasklist utility displays a list of applications and services with their Process IDs (PID) for all tasks running on either a local or a remote computer. It is packaged with Windows operating systems and can be executed from the command-line interface. [1]
3
TechniquesBottom 12%
1
TacticBottom 6%
13
Threat groupsunranked
3
Campaignsunranked
Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.
Tasklist can be used to enumerate security software currently running on a system by process name of known products.4
Discovery9 detection rules
Standing S0057
Reach is how much of ATT&CK this tool touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.
Reach
Techniques3Bottom 12%
12th percentile · 88% of 825 ATT&CK software entries have more Enterprise techniques.
Tactic1Bottom 6%
6th percentile · 94% of 825 ATT&CK software entries have more tactics spanned.
Threat groups1361% tie · 22 values
61% of the population shares a single value across only 22 distinct values, so a percentile here would rank the tie, not the entity.
Campaigns385% tie · 8 values
85% of the population shares a single value across only 8 distinct values, so a percentile here would rank the tie, not the entity.
Coverage
Rules / technique10medBottom 15%
15th percentile · 85% of 825 ATT&CK software entries have more detection rules per technique.
Tests / technique10med
Tasklist detections S0057
31 distinct rules cover the 3 techniques recorded for this tool. 28 Sigma · 3 Splunk.
3 covered by at least one rule31 distinct rules in total
Showing 1-31 of 31 rules
Drag headers to reorder | Drag edges to resize
Select
Title
Description
Category
Status
Event
OS
Product
MITRE ATT&CK
CVEs
Severity
Author
Created
Updated
ID
Refs
Find information about network devices that is not stored in config files
Detects execution of the "esxcli" command with the "storage" flag in order to retrieve information about the storage status and other related information. (...)
Detects AppLocker policy enumeration attempts via PowerShell using the Get-AppLockerPolicy cmdlet and an policy scope of either Effective, LDAP, or Local.
Detects use of the sysinfo system call in Linux, which provides a snapshot of key system statistics such as uptime, load averages, memory usage, and the number of running processes. (...)
The following analytic detects the enumeration of Windows services using the net start command, which is a built-in utility that lists all running services on a system. (...)
The following analytic detects the use of Windows Management Instrumentation Command-line (WMIC) to retrieve information about running processes, specifically targeting the command lines used to launch those processes. (...)