MirrorFaceG1054 ↗
tfMITRE ATT&CK technique
Process Discovery T1057
- Tactic
- Discovery
- Platforms
- ESXi, Linux, macOS, Network Devices, Windows
- Version
- 1.6
- Created
- 31 May 2017
- Last modified
- 12 May 2026
- Contributor
- Austin Clark, @c2defense
Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Administrator or otherwise elevated access may provide better process details. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
41
Threat groupsTop 3%
Threat groups97th percentile · 97% of ATT&CK techniques have this many threat groups attributed or fewer.10
CampaignsTop 3%
Campaigns97th percentile · 97% of ATT&CK techniques have this many campaigns recorded or fewer.268
Tools & malwareTop 1%
Tools & malware99th percentile · 99% of ATT&CK techniques have this many tools implementing them or fewer.10
Detection rules74th pct
Detection rules74th percentile · 74% of ATT&CK techniques have this many detection rules written or fewer.Process Discovery MITRE reference T1057
Top 3%of all ATT&CK techniques for number of groups
41 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
Storm-0501G1053 ↗
Has discovered running processes through tasklist.exe.1
Medusa GroupG1051 ↗
Has utilized a hard-coded security tool process list that identifies and terminates using an undocumented IOCTL code 0x222094.1
UNC3886G1048 ↗
Has run scripts to list all running processes on a guest VM from an ESXi host.1
PlayG1040 ↗
Has used the information stealer Grixba to check for a list of security processes.1
APT5G1023 ↗
Has used Windows-based utilities to carry out tasks including tasklist.exe. 1
All 41 groups for this technique · 6 newest in this preview
10 campaigns have been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.
2025 Poland Wiper AttacksC0063 ↗
During the 2025 Poland Wiper Attacks, the adversaries enumerated current running processes using tasklist.1
RedPenguinC0056 ↗
During RedPenguin, UNC3886 used malware capable of reading the PID for the Junos OS snmpd daemon.1
KV Botnet ActivityC0035 ↗
Scripts associated with KV Botnet Activity initial deployment can identify processes related to security tools and other botnet families for follow-on disabling during installation.1
C0015C0015 ↗
During C0015, the threat actors used the tasklist /s command as well as taskmanager to obtain a list of running processes.1
Operation CuckooBeesC0012 ↗
During Operation CuckooBees, the threat actors used the tasklist command as part of their advanced reconnaissance.1
SolarWinds CompromiseC0024 ↗
During the SolarWinds Compromise, APT29 used multiple command-line utilities to enumerate running processes.123
All 10 campaigns for this technique · 6 newest in this preview
268 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
TeamPCP Cloud StealerS9041 ↗
LP-NotesS9036 ↗
Has searched for the process taskhostw.exe.1
LAMEHUGS9035 ↗
MuddyViperS9032 ↗
Has the ability to collect running processes.1
AshTagS9031 ↗
The AshTag AshenOrchestrator component has process management functionality.1
SPAWNCHIMERAS9024 ↗
Has searched for running processes to include web or dsmdm.12
All 268 software entries for this technique · 6 newest in this preview
Offense vs defense T1057
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 10Sigma rules (cumulative) · 9Splunk ESCU (cumulative) · 1
first rule: 2019 Q3 · 10 of 10 campaigns plottedProcess Discovery detection strategy DET0034
MITRE names one behaviour worth catching for this technique and breaks it into 5 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detection of Adversarial Process Discovery Behavior
5 platforms
AN0095 · Windows
Identifies adversary behavior that launches commands or invokes APIs to enumerate active processes (e.g., tasklist.exe, Get-Process, or CreateToolhelp32Snapshot). Detects execution combined with parent process lineage, network session context, or remote origin.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | WinEventLog:Security | EventCode=4688 |
| Process AccessDC0035 | WinEventLog:Sysmon | EventCode=10 |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| ParentProcessName | Used to scope suspicious discovery from non-interactive or non-standard parent processes like Office macros, WMI, or script engines |
| CommandLinePattern | Adversaries may obfuscate or vary process discovery commands (e.g., aliases, PowerShell variants) |
| TimeWindow | Helps detect bursty discovery behavior within a short timeframe |
AN0096 · Linux
Detects execution of common process enumeration utilities (e.g., ps, top, htop) or access to /proc with suspicious ancestry. Correlates command usage with interactive shell context and user role.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | auditd:SYSCALL | execve |
| Process AccessDC0035 | linux:osquery | Process State |
| File AccessDC0055 | auditd:SYSCALL | openat |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| AccessedPath | Filter based on suspicious /proc directory enumeration or high-volume ls/readlink usage |
| UserContext | Helps tune for root vs. low-priv users during interactive vs. scripted activity |
AN0097 · macOS
Monitors execution of ps, top, or launchctl with unusual parent processes or from terminal scripts. Also detects AppleScript-based process listing or system_profiler SPApplicationsDataType misuse.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | macos:unifiedlog | process launch |
| Process MetadataDC0034 | macos:osquery | Process Context |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| ParentApp | Tunable to detect discovery from non-UI tools or script-based execution (osascript, zsh, cron) |
AN0098 · ESXi
Detects process enumeration using esxcli system process list or ps on ESXi shell or via unauthorized SSH sessions. Correlates with interactive sessions and abnormal user roles.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process MetadataDC0034 | esxi:auth | user session |
| Command ExecutionDC0064 | esxi:shell | interactive shell |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| User | Admins are expected to run these commands—flag if non-admin or unknown users do |
AN0099 · Network Devices
Monitors CLI-based execution of show process or equivalent on routers/switches. Correlates unusual device access, unauthorized roles, or config mode changes.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process MetadataDC0034 | networkdevice:syslog | Admin activity |
| Command ExecutionDC0064 | networkdevice:cli | CLI command |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| Username | Tunable based on authorized operators for network infrastructure |
| CommandString | Pattern match or regex scope for discovery commands |
2 analytics
Certain commands are frequently used by malicious actors and infrequently used by normal users. By looking for execution of these commands in short periods of time, we can not only see when a malicious user was on the system but also get an idea of what they were doing.
D3FEND techniques
The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.
| ID | Name |
|---|---|
| D3-PLA | Process Lineage Analysis |
Data model references
The CAR data model objects, actions and fields the logic reads. Map these to your own schema before implementing.
| Object | Action | Field |
|---|---|---|
| process | create | hostname |
| process | create | ppid |
| process | create | exe |
Implementations
Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.
processes = search Process:Create reg_processes = filter processes where (exe == "arp.exe" or exe == "at.exe" or exe == "attrib.exe" or exe == "cscript.exe" or exe == "dsquery.exe" or exe == "hostname.exe" or exe == "ipconfig.exe" or exe == "mimikatz.exe" or exe == "nbstat.exe" or exe == "net.exe" or exe == "netsh.exe" or exe == "nslookup.exe" or exe == "ping.exe" or exe == "quser.exe" or exe == "qwinsta.exe" or exe == "reg.exe" or exe == "runas.exe" or exe == "sc.exe" or exe == "schtasks.exe" or exe == "ssh.exe" or exe == "systeminfo.exe" or exe == "taskkill.exe" or exe == "telnet.exe" or exe == "tracert.exe" or exe == "wscript.exe" or exe == "xcopy.exe") reg_grouped = group reg by hostname, ppid where(max time between two events is 30 minutes) output reg_grouped
Sigma version of the above pseudocode, with some modifications.
DNIF version of the above pseudocode.
_fetch * from event where $LogName=WINDOWS-SYSMON AND $EventID=1 AND $App=regex(arp\.exe|at\.exe|attrib\.exe|cscript\.exe|dsquery\.exe|hostname\.exe|ipconfig\.exe|mimikatz.exe|nbstat\.exe|net\.exe|netsh\.exe|nslookup\.exe|ping\.exe|quser\.exe|qwinsta\.exe|reg\.exe|runas\.exe|sc\.exe|schtasks\.exe|ssh\.exe|systeminfo\.exe|taskkill\.exe|telnet\.exe|tracert\.exe|wscript\.exe|xcopy\.exe)i group count_unique $App limit 100 >>_agg count >>_checkif int_compare Count > 1 include
LogPoint version of the above pseudocode.
norm_id=WindowsSysmon event_id=1 image IN ["*\arp.exe", "*\at.exe", "*\attrib.exe", "*\cscript.exe", "*\dsquery.exe", "*\hostname.exe", "*\ipconfig.exe", "*\mimikatz.exe", "*\nbstat.exe", "*\net.exe", "*\netsh.exe", "*\nslookup.exe", "*\ping.exe", "*\quser.exe", "*\qwinsta.exe", "*\reg.exe", "*\runas.exe", "*\sc.exe", "*\schtasks.exe", "*\ssh.exe", "*\systeminfo.exe", "*\taskkill.exe", "*\telnet.exe", "*\tracert.exe", "*\wscript.exe", "*\xcopy.exe"] | chart count() as cnt by host | search cnt > 1
Unit tests
CAR’s own validation procedures for this analytic.
Within a command window, execute several of the commands in quick succession.
["ipconfig /all","hostname","systeminfo","reg.exe Query HKLM\\Software\\Microsoft"]
When entering on a host for the first time, an adversary may try to discover information about the host. There are several built-in Windows commands that can be used to learn about the software configurations, active users, administrators, and networking configuration. These commands should be monitored to identify when an adversary is learning information about the system and environment. The information returned may impact choices an adversary can make when establishing persistence, escalating privileges, or moving laterally.
D3FEND techniques
The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.
| ID | Name |
|---|---|
| D3-PSA | Process Spawn Analysis |
Data model references
The CAR data model objects, actions and fields the logic reads. Map these to your own schema before implementing.
| Object | Action | Field |
|---|---|---|
| process | create | command_line |
| process | create | exe |
Implementations
Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.
To be effective in deciphering malicious and benign activity, the full command line is essential. Similarly, having information about the parent process can help with making decisions and tuning to an environment.
process = search Process:Create info_command = filter process where ( exe == "hostname.exe" or exe == "ipconfig.exe" or exe == "net.exe" or exe == "quser.exe" or exe == "qwinsta.exe" or exe == "sc" and (command_line match " query" or command_line match " qc")) or exe == "systeminfo.exe" or exe == "tasklist.exe" or exe == "whoami.exe" ) output info_command
Splunk version of the above pseudocode search.
index=__your_sysmon_index__ EventCode=1 (Image="C:\\Windows\\*\\hostname.exe" OR Image="C:\\Windows\\*\\ipconfig.exe" OR Image="C:\\Windows\\*\\net.exe" OR Image="C:\\Windows\\*\\quser.exe" OR Image="C:\\Windows\\*\\qwinsta.exe" OR (Image="C:\\Windows\\*\\sc.exe" AND (CommandLine="* query *" OR CommandLine="* qc *")) OR Image="C:\\Windows\\*\\systeminfo.exe" OR Image="C:\\Windows\\*\\tasklist.exe" OR Image="C:\\Windows\\*\\whoami.exe")|stats values(Image) as "Images" values(CommandLine) as "Command Lines" by ComputerName
EQL version of the above pseudocode search.
process where subtype.create and (process_name == "hostname.exe" or process_name == "ipconfig.exe" or process_name == "net.exe" or process_name == "quser.exe" process_name == "qwinsta.exe" or process_name == "systeminfo.exe" or process_name == "tasklist.exe" or process_name == "whoami.exe" or (process_name == "sc.exe" and (command_line == "* query *" or command_line == "* qc *")))
LogPoint version of the above pseudocode.
norm_id=WindowsSysmon event_id=1 (image in ["*\hostname.exe", "*\ipconfig.exe", "*\net.exe", "*\quser.exe", "*\qwinsta.exe", "*\systeminfo.exe", "*\tasklist.exe", "*\whoami.exe"] OR (image="*\sc.exe" command IN ["* query *", "* qc *"))
Tests9Executorscmd 4 · PowerShell 4 · sh 1Need elevation2 of 9Have prerequisites2Have cleanup1Platformslinux, macos, windows
| # | Test | Platform | Executor | Elevation | Prereqs | Cleanup | Ref | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 01 | Process Discovery - ps | linux, macos | sh | — | — | Yes | ||||||||||
Utilize ps to identify processes. Upon successful execution, sh will execute ps and output to /tmp/loot.txt. Input arguments
Attack command ps >> #{output_file}
ps aux >> #{output_file}
Cleanup command rm #{output_file}
GUIDc2e70717-96ba-4ec0-a0d6-5c713f8403b8 | ||||||||||||||||
| 02 | Process Discovery - tasklist | windows | cmd | — | — | — | ||||||||||
Utilize tasklist to identify processes. Upon successful execution, cmd.exe will execute tasklist.exe to list processes. Output will be via stdout. Attack command tasklist GUID627c7f2d-319e-411e-8950-ea908cf6aeae | ||||||||||||||||
| 03 | Process Discovery - Get-Process | windows | PowerShell | — | — | — | ||||||||||
Utilize Get-Process PowerShell cmdlet to identify processes. Upon successful execution, powershell.exe will execute Get-Process to list processes. Output will be via stdout. Attack command Get-Process GUID77a87120-b2c3-4ef3-b7f2-04c350eef032 | ||||||||||||||||
| 04 | Process Discovery - get-wmiObject | windows | PowerShell | — | — | — | ||||||||||
Utilize get-wmiObject PowerShell cmdlet to identify processes. Upon successful execution, powershell.exe will execute get-wmiObject to list processes. Output will be via stdout. Attack command get-wmiObject -class Win32_Process GUIDb5721904-7197-4180-938a-31d3ce53fdad | ||||||||||||||||
| 05 | Process Discovery - wmic process | windows | cmd | — | — | — | ||||||||||
Utilize windows management instrumentation to identify processes. Upon successful execution, WMIC will execute process to list processes. Output will be via stdout. Attack command wmic process get /format:list GUIDbcf35b01-fc75-4158-b2cf-7fc968076b3a | ||||||||||||||||
| 06 | Discover Specific Process - tasklist | windows | cmd | — | — | — | ||||||||||
Adversaries may use command line tools to discover specific processes in preparation of further attacks. Examples of this could be discovering the PID of lsass.exe to dump its memory or discovering whether specific security processes (e.g. AV or EDR) are running. Input arguments
Attack command tasklist | findstr #{process_to_enumerate}
GUID134ec92c-b3b9-47cb-9ef9-e9eec2fa1e95 | ||||||||||||||||
| 07 | Process Discovery - Process Hacker | windows | PowerShell | Required | 1 | — | ||||||||||
Process Hacker can be exploited to infiltrate system processes, identify weak points, or achieve unauthorized control over systems. However, its malicious use can often be flagged by security defenses, rendering it a perilous tool for illegitimate purposes. Input arguments
Attack command Start-Process -FilePath "$Env:ProgramFiles\Process Hacker 2\#{processhacker_exe}"Prerequisite Process Hacker must be installed in the location Check if (Test-Path "c:\Program Files\Process Hacker 2\#{processhacker_exe}") {exit 0} else {exit 1}
Satisfy Write-Host Downloading Process Hacker New-Item -Type Directory "C:\Temp\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null Invoke-WebRequest "https://versaweb.dl.sourceforge.net/project/processhacker/processhacker2/processhacker-2.39-setup.exe" -OutFile "C:\Temp\ExternalPayloads\processhacker-2.39-setup.exe" Write-Host Installing Process Hacker Start-Process "c:\Temp\ExternalPayloads\processhacker-2.39-setup.exe" -Wait -ArgumentList "/s" GUID4a6588c8-979d-4a0f-bcbd-c69340b1ebd1 | ||||||||||||||||
| 08 | Process Discovery - PC Hunter | windows | PowerShell | Required | 1 | — | ||||||||||
PC Hunter is a toolkit with access to hundreds of settings including kernels, kernel modules, processes, network, startup, and more. When abused, this tool can allow threat actors to effectively access sensitive processes, collect system information, and terminate security software. Input arguments
Attack command Start-Process -FilePath "C:\Temp\ExternalPayloads\PCHunter_free\#{pchunter64_exe}"Prerequisite PCHunter must be present in device Check if (Get-ChildItem -Path C:\ -Include *PCHunter64* -File -Recurse -ErrorAction SilentlyContinue) {exit 0} else {exit 1}
Satisfy Write-Host Downloading PC Hunter New-Item -Type Directory "C:\Temp\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null Invoke-WebRequest "https://www.snapfiles.com/directdl/PCHunter_free.zip" -OutFile "C:\Temp\ExternalPayloads\PCHunter_free.zip" Expand-Archive -LiteralPath 'C:\Temp\ExternalPayloads\PCHunter_free.zip' -DestinationPath C:\Temp\ExternalPayloads Write-Host Unzipping Installing Process Hunter GUIDd226caeb-fa0f-4d21-b4f4-692c0b236f22 | ||||||||||||||||
| 09 | Launch Taskmgr from cmd to View running processes | windows | cmd | — | — | — | ||||||||||
An adverary may launch taskmgr.exe with the /7 switch via command prompt to view processes running on the system. Reference Attack command taskmgr.exe /7 GUIDf35a6284-f172-4021-ae1b-8ae478a63f80 | ||||||||||||||||
Tests from Atomic Red Team (MIT licence) · technique definition