Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Administrator or otherwise elevated access may provide better process details. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
In Windows environments, adversaries could obtain details on running processes using the Tasklist utility via cmd or Get-Process via PowerShell. Information about processes can also be extracted from the output of Native API calls such as CreateToolhelp32Snapshot. In Mac and Linux, this is accomplished with the ps command. Adversaries may also opt to enumerate processes via /proc. ESXi also supports use of the ps command, as well as esxcli system process list.[1][2]
On network devices, Network Device CLI commands such as show processes can be used to display current running processes.[3][4]
Top 3%of all ATT&CK techniques for number of groups
41 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
Scripts associated with KV Botnet Activity initial deployment can identify processes related to security tools and other botnet families for follow-on disabling during installation.1
All 10 campaigns for this technique · 6 newest in this preview
268 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
MITRE names one behaviour worth catching for this technique and breaks it into 5 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detection of Adversarial Process Discovery Behavior
Enterprise
5 platforms
AN0095 · Windows
Identifies adversary behavior that launches commands or invokes APIs to enumerate active processes (e.g., tasklist.exe, Get-Process, or CreateToolhelp32Snapshot). Detects execution combined with parent process lineage, network session context, or remote origin.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
Field
What you tune
ParentProcessName
Used to scope suspicious discovery from non-interactive or non-standard parent processes like Office macros, WMI, or script engines
CommandLinePattern
Adversaries may obfuscate or vary process discovery commands (e.g., aliases, PowerShell variants)
TimeWindow
Helps detect bursty discovery behavior within a short timeframe
AN0096 · Linux
Detects execution of common process enumeration utilities (e.g., ps, top, htop) or access to /proc with suspicious ancestry. Correlates command usage with interactive shell context and user role.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
Field
What you tune
AccessedPath
Filter based on suspicious /proc directory enumeration or high-volume ls/readlink usage
UserContext
Helps tune for root vs. low-priv users during interactive vs. scripted activity
AN0097 · macOS
Monitors execution of ps, top, or launchctl with unusual parent processes or from terminal scripts. Also detects AppleScript-based process listing or system_profiler SPApplicationsDataType misuse.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
Field
What you tune
ParentApp
Tunable to detect discovery from non-UI tools or script-based execution (osascript, zsh, cron)
AN0098 · ESXi
Detects process enumeration using esxcli system process list or ps on ESXi shell or via unauthorized SSH sessions. Correlates with interactive sessions and abnormal user roles.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
Field
What you tune
User
Admins are expected to run these commands—flag if non-admin or unknown users do
AN0099 · Network Devices
Monitors CLI-based execution of show process or equivalent on routers/switches. Correlates unusual device access, unauthorized roles, or config mode changes.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
Field
What you tune
Username
Tunable based on authorized operators for network infrastructure
CommandString
Pattern match or regex scope for discovery commands
2 analytics
Certain commands are frequently used by malicious actors and infrequently used by normal users. By looking for execution of these commands in short periods of time, we can not only see when a malicious user was on the system but also get an idea of what they were doing.
TypeTTPCoverageLowSubmitted2013
D3FEND techniques
The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.
Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.
processes = search Process:Create
reg_processes = filter processes where (exe == "arp.exe" or exe == "at.exe" or exe == "attrib.exe"
or exe == "cscript.exe" or exe == "dsquery.exe" or exe == "hostname.exe"
or exe == "ipconfig.exe" or exe == "mimikatz.exe" or exe == "nbstat.exe"
or exe == "net.exe" or exe == "netsh.exe" or exe == "nslookup.exe"
or exe == "ping.exe" or exe == "quser.exe" or exe == "qwinsta.exe"
or exe == "reg.exe" or exe == "runas.exe" or exe == "sc.exe"
or exe == "schtasks.exe" or exe == "ssh.exe" or exe == "systeminfo.exe"
or exe == "taskkill.exe" or exe == "telnet.exe" or exe == "tracert.exe"
or exe == "wscript.exe" or exe == "xcopy.exe")
reg_grouped = group reg by hostname, ppid where(max time between two events is 30 minutes)
output reg_grouped
Sigma version of the above pseudocode, with some modifications.
DNIF version of the above pseudocode.
_fetch * from event where $LogName=WINDOWS-SYSMON AND $EventID=1 AND $App=regex(arp\.exe|at\.exe|attrib\.exe|cscript\.exe|dsquery\.exe|hostname\.exe|ipconfig\.exe|mimikatz.exe|nbstat\.exe|net\.exe|netsh\.exe|nslookup\.exe|ping\.exe|quser\.exe|qwinsta\.exe|reg\.exe|runas\.exe|sc\.exe|schtasks\.exe|ssh\.exe|systeminfo\.exe|taskkill\.exe|telnet\.exe|tracert\.exe|wscript\.exe|xcopy\.exe)i group count_unique $App limit 100
>>_agg count
>>_checkif int_compare Count > 1 include
When entering on a host for the first time, an adversary may try to discover information about the host. There are several built-in Windows commands that can be used to learn about the software configurations, active users, administrators, and networking configuration. These commands should be monitored to identify when an adversary is learning information about the system and environment. The information returned may impact choices an adversary can make when establishing persistence, escalating privileges, or moving laterally.
TypeTTPCoverageModerateSubmitted2016
D3FEND techniques
The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.
Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.
To be effective in deciphering malicious and benign activity, the full command line is essential. Similarly, having information about the parent process can help with making decisions and tuning to an environment.
process = search Process:Create
info_command = filter process where (
exe == "hostname.exe" or
exe == "ipconfig.exe" or
exe == "net.exe" or
exe == "quser.exe" or
exe == "qwinsta.exe" or
exe == "sc" and (command_line match " query" or command_line match " qc")) or
exe == "systeminfo.exe" or
exe == "tasklist.exe" or
exe == "whoami.exe"
)
output info_command
Splunk version of the above pseudocode search.
index=__your_sysmon_index__ EventCode=1 (Image="C:\\Windows\\*\\hostname.exe" OR Image="C:\\Windows\\*\\ipconfig.exe" OR Image="C:\\Windows\\*\\net.exe" OR Image="C:\\Windows\\*\\quser.exe" OR Image="C:\\Windows\\*\\qwinsta.exe" OR (Image="C:\\Windows\\*\\sc.exe" AND (CommandLine="* query *" OR CommandLine="* qc *")) OR Image="C:\\Windows\\*\\systeminfo.exe" OR Image="C:\\Windows\\*\\tasklist.exe" OR Image="C:\\Windows\\*\\whoami.exe")|stats values(Image) as "Images" values(CommandLine) as "Command Lines" by ComputerName
EQL version of the above pseudocode search.
process where subtype.create and
(process_name == "hostname.exe" or process_name == "ipconfig.exe" or process_name == "net.exe" or process_name == "quser.exe" process_name == "qwinsta.exe" or process_name == "systeminfo.exe" or process_name == "tasklist.exe" or process_name == "whoami.exe" or (process_name == "sc.exe" and (command_line == "* query *" or command_line == "* qc *")))
LogPoint version of the above pseudocode.
norm_id=WindowsSysmon event_id=1 (image in ["*\hostname.exe", "*\ipconfig.exe", "*\net.exe", "*\quser.exe", "*\qwinsta.exe", "*\systeminfo.exe", "*\tasklist.exe", "*\whoami.exe"] OR (image="*\sc.exe" command IN ["* query *", "* qc *"))
Tests10Executorspowershell 5 · command_prompt 4 · sh 1Need elevation2 of 10Have prerequisites2Have cleanup1Platformslinux, macos, windows
#
Test
Platform
Executor
Elevation
Prereqs
Cleanup
Ref
01
Process Discovery - ps
linux, macos
sh
—
—
Yes
Utilize ps to identify processes.
Upon successful execution, sh will execute ps and output to /tmp/loot.txt.
Inputs
Name
Description
Type
Default Value
output_file
path of output file
path
/tmp/loot.txt
Attack Commandsrun with sh
ps >> #{output_file}
ps aux >> #{output_file}
Cleanup Commands
rm #{output_file}
GUID4ff64f0b-aaf2-4866-b39d-38d9791407cc
02
Process Discovery - tasklist
windows
command_prompt
—
—
—
Utilize tasklist to identify processes.
Upon successful execution, cmd.exe will execute tasklist.exe to list processes. Output will be via stdout.
Attack Commandsrun with command_prompt
tasklist
GUIDc5806a4f-62b8-4900-980b-c7ec004e9908
03
Process Discovery - Get-Process
windows
powershell
—
—
—
Utilize Get-Process PowerShell cmdlet to identify processes.
Upon successful execution, powershell.exe will execute Get-Process to list processes. Output will be via stdout.
Attack Commandsrun with powershell
Get-Process
GUID3b3809b6-a54b-4f5b-8aff-cb51f2e97b34
04
Process Discovery - get-wmiObject
windows
powershell
—
—
—
Utilize get-wmiObject PowerShell cmdlet to identify processes.
Upon successful execution, powershell.exe will execute get-wmiObject to list processes. Output will be via stdout.
Attack Commandsrun with powershell
get-wmiObject -class Win32_Process
GUIDb51239b4-0129-474f-a2b4-70f855b9f2c2
05
Process Discovery - wmic process
windows
command_prompt
—
—
—
Utilize windows management instrumentation to identify processes.
Upon successful execution, WMIC will execute process to list processes. Output will be via stdout.
Attack Commandsrun with command_prompt
wmic process get /format:list
GUID640cbf6d-659b-498b-ba53-f6dd1a1cc02c
06
Discover Specific Process - tasklist
windows
command_prompt
—
—
—
Adversaries may use command line tools to discover specific processes in preparation of further attacks.
Examples of this could be discovering the PID of lsass.exe to dump its memory or discovering whether specific security processes (e.g. AV or EDR) are running.
Inputs
Name
Description
Type
Default Value
process_to_enumerate
Process name string to search for.
string
lsass
Attack Commandsrun with command_prompt
tasklist | findstr #{process_to_enumerate}
GUID11ba69ee-902e-4a0f-b3b6-418aed7d7ddb
07
Process Discovery - Process Hacker
windows
powershell
Required
1
—
Process Hacker can be exploited to infiltrate system processes, identify weak points, or achieve unauthorized control over systems. However, its malicious use can often be flagged by security defenses, rendering it a perilous tool for illegitimate purposes.
Inputs
Name
Description
Type
Default Value
processhacker_exe
Process hacker installation executables.
string
ProcessHacker.exe
Attack Commandsrun with powershellelevation required (root or admin)
PC Hunter is a toolkit with access to hundreds of settings including kernels, kernel modules, processes, network, startup, and more. When abused, this tool can allow threat actors to effectively access sensitive processes, collect system information, and terminate security software.
Inputs
Name
Description
Type
Default Value
pchunter64_exe
Process hacker installation executables.
string
PChunter64.exe
Attack Commandsrun with powershellelevation required (root or admin)
An adverary may launch taskmgr.exe with the /7 switch via command prompt to view processes running on the system.
Reference
Attack Commandsrun with command_prompt
taskmgr.exe /7
GUID4fd35378-39aa-481e-b7c4-e3bf49375c67
10
Check Process Token Elevation via GetTokenInformation
windows
powershell
—
—
—
Uses C# P/Invoke to call OpenProcessToken and GetTokenInformation with TokenElevation
to discover whether the current process is running with elevated privileges. Adversaries
use this API-level check to determine their privilege context before deciding whether
to attempt privilege escalation. Turla's ApolloShadow does this to determine its path of execution.
Reference: https://www.microsoft.com/en-us/security/blog/2025/07/31/frozen-in-transit-secret-blizzards-aitm-campaign-against-diplomats/
Attack Commandsrun with powershell
Add-Type -TypeDefinition @'
using System;
using System.Runtime.InteropServices;
public class TokenElevationCheck
{
[DllImport("advapi32.dll", SetLastError = true)]
static extern bool OpenProcessToken(IntPtr ProcessHandle, uint DesiredAccess, out IntPtr TokenHandle);
[DllImport("advapi32.dll", SetLastError = true)]
static extern bool GetTokenInformation(IntPtr TokenHandle, int TokenInformationClass, out int TokenInformation, int TokenInformationLength, out int ReturnLength);
[DllImport("kernel32.dll")]
static extern IntPtr GetCurrentProcess();
[DllImport("kernel32.dll", SetLastError = true)]
static extern bool CloseHandle(IntPtr hObject);
const uint TOKEN_QUERY = 0x0008;
const int TokenElevationType = 18;
public static void Check()
{
IntPtr hToken;
if (!OpenProcessToken(GetCurrentProcess(), TOKEN_QUERY, out hToken))
{
Console.WriteLine("OpenProcessToken failed: " + Marshal.GetLastWin32Error());
return;
}
int elevationType, returnLength;
if (GetTokenInformation(hToken, TokenElevationType, out elevationType, 4, out returnLength))
{
string[] labels = { "", "Default", "Full", "Limited" };
Console.WriteLine("TokenElevationType: " + labels[elevationType]);
}
CloseHandle(hToken);
}
}
'@
[TokenElevationCheck]::Check()
Detects use of the sysinfo system call in Linux, which provides a snapshot of key system statistics such as uptime, load averages, memory usage, and the number of running processes. (...)
The following analytic detects the use of Windows Management Instrumentation Command-line (WMIC) to retrieve information about running processes, specifically targeting the command lines used to launch those processes. (...)