Куда я попал?

SECURITM это SGRC система, автоматизирующая процессы в службах информационной безопасности. SECURITM помогает построить и управлять ИСПДн, КИИ, ГИС, СМИБ/СУИБ, банковскими системами защиты.
А еще SECURITM это место для обмена опытом и наработками для служб безопасности.

Подробнее

Process Discovery

Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Administrator or otherwise elevated access may provide better process details. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. In Windows environments, adversaries could obtain details on running processes using the Tasklist utility via cmd or Get-Process via PowerShell. Information about processes can also be extracted from the output of Native API calls such as CreateToolhelp32Snapshot. In Mac and Linux, this is accomplished with the ps command. Adversaries may also opt to enumerate processes via `/proc`. ESXi also supports use of the `ps` command, as well as `esxcli system process list`.(Citation: Sygnia ESXi Ransomware 2025)(Citation: Crowdstrike Hypervisor Jackpotting Pt 2 2021) On network devices, Network Device CLI commands such as `show processes` can be used to display current running processes.(Citation: US-CERT-TA18-106A)(Citation: show_processes_cisco_cmd)

ID: T1057

Tactic(s): Discovery

Platforms: ESXi, Linux, Network Devices, Windows, macOS

Data Sources: Command: Command Execution, Process: OS API Execution, Process: Process Creation

Version: 1.6

Created: 31 May 2017

Last Modified: 15 Apr 2025

Name	Description
Procedure Examples
TrickBot	TrickBot uses module networkDll for process list discovery.(Citation: ESET Trickbot Oct 2020)(Citation: Bitdefender Trickbot March 2020)
PowerDuke	PowerDuke has a command to list the victim's processes.(Citation: Volexity PowerDuke November 2016)
EKANS	EKANS looks for processes from a hard-coded list.(Citation: Dragos EKANS)(Citation: FireEye Ransomware Feb 2020)(Citation: IBM Ransomware Trends September 2020)
Ninja	Ninja can enumerate processes on a targeted host.(Citation: Kaspersky ToddyCat June 2022)(Citation: Kaspersky ToddyCat Check Logs October 2023)
RCSession	RCSession can identify processes based on PID.(Citation: Profero APT27 December 2020)
SynAck	SynAck enumerates all running processes.(Citation: SecureList SynAck Doppelgänging May 2018)(Citation: Kaspersky Lab SynAck May 2018)
Bumblebee	Bumblebee can identify processes associated with analytical tools.(Citation: Proofpoint Bumblebee April 2022)(Citation: Symantec Bumblebee June 2022)(Citation: Medium Ali Salem Bumblebee April 2022)
Proxysvc	Proxysvc lists processes running on the system.(Citation: McAfee GhostSecret)
Orz	Orz can gather a process list from the victim.(Citation: Proofpoint Leviathan Oct 2017)
yty	yty gets an output of running processes using the `tasklist` command.(Citation: ASERT Donot March 2018)
Backdoor.Oldrea	Backdoor.Oldrea collects information about running processes.(Citation: Symantec Dragonfly)
RotaJakiro	RotaJakiro can monitor the `/proc/[PID]` directory of known RotaJakiro processes as a part of its persistence when executing with non-root permissions. If the process is found dead, it resurrects the process. RotaJakiro processes can be matched to an associated Advisory Lock, in the `/proc/locks` folder, to ensure it doesn't spawn more than one process.(Citation: RotaJakiro 2021 netlab360 analysis)
AvosLocker	AvosLocker has discovered system processes by calling `RmGetList`.(Citation: Malwarebytes AvosLocker Jul 2021)
Get2	Get2 has the ability to identify running processes on an infected host.(Citation: Proofpoint TA505 October 2019)
POWRUNER	POWRUNER may collect process information by running `tasklist` on a victim.(Citation: FireEye APT34 Dec 2017)
KOPILUWAK	KOPILUWAK can enumerate current running processes on the targeted machine.(Citation: Mandiant Suspected Turla Campaign February 2023)
COATHANGER	COATHANGER will query running process information to determine subsequent program execution flow.(Citation: NCSC-NL COATHANGER Feb 2024)
Sardonic	Sardonic has the ability to execute the `tasklist` command.(Citation: Bitdefender Sardonic Aug 2021)
HALFBAKED	HALFBAKED can obtain information about running processes on the victim.(Citation: FireEye FIN7 April 2017)
ShimRatReporter	ShimRatReporter listed all running processes on the machine.(Citation: FOX-IT May 2016 Mofang)
KEYMARBLE	KEYMARBLE can obtain a list of running processes on the system.(Citation: US-CERT KEYMARBLE Aug 2018)
SILENTTRINITY	SILENTTRINITY can enumerate processes, including properties to determine if they have the Common Language Runtime (CLR) loaded.(Citation: GitHub SILENTTRINITY Modules July 2019)
PowerSploit	PowerSploit's `Get-ProcessTokenPrivilege` Privesc-PowerUp module can enumerate privileges for a given process.(Citation: GitHub PowerSploit May 2012)(Citation: PowerSploit Documentation)
Ursnif	Ursnif has gathered information about running processes.(Citation: TrendMicro Ursnif Mar 2015)(Citation: TrendMicro BKDR_URSNIF.SM)
RansomHub	RansomHub can stop processes associated with files currently in use to maximize the impact of encryption.(Citation: CISA RansomHub AUG 2024)
Zeus Panda	Zeus Panda checks for running processes on the victim’s machine.(Citation: GDATA Zeus Panda June 2017)
GeminiDuke	GeminiDuke collects information on running processes and environment variables from the victim.(Citation: F-Secure The Dukes)
FrameworkPOS	FrameworkPOS can enumerate and exclude selected processes on a compromised host to speed execution of memory scraping.(Citation: SentinelOne FrameworkPOS September 2019)
GravityRAT	GravityRAT lists the running processes on the system.(Citation: Talos GravityRAT)
Bankshot	Bankshot identifies processes and collects the process ids.(Citation: McAfee Bankshot)
StrongPity	StrongPity can determine if a user is logged in by checking to see if explorer.exe is running.(Citation: Talos Promethium June 2020)
PLAINTEE	PLAINTEE performs the `tasklist` command to list running processes.(Citation: Rancor Unit42 June 2018)
WinMM	WinMM sets a WH_CBT Windows hook to collect information on process creation.(Citation: Baumgartner Naikon 2015)
Nebulae	Nebulae can enumerate processes on a target system.(Citation: Bitdefender Naikon April 2021)
UPSTYLE	UPSTYLE has the ability to read `/proc/self/cmdline` to see if it is running as a monitored process.(Citation: Palo Alto MidnightEclipse APR 2024)
Kasidet	Kasidet has the ability to search for a given process name in processes currently running in the system.(Citation: Zscaler Kasidet)
OceanSalt	OceanSalt can collect the name and ID for every process running on the system.(Citation: McAfee Oceansalt Oct 2018)
Brave Prince	Brave Prince lists the running processes.(Citation: McAfee Gold Dragon)
RainyDay	RainyDay can enumerate processes on a target system.(Citation: Bitdefender Naikon April 2021)
AppleSeed	AppleSeed can enumerate the current process on a compromised host.(Citation: Malwarebytes Kimsuky June 2021)
macOS.OSAMiner	macOS.OSAMiner has used `ps ax \| grep \| grep -v grep \| ...` and `ps ax \| grep -E...` to conduct process discovery.(Citation: SentinelLabs reversing run-only applescripts 2021)
NETWIRE	NETWIRE can discover processes on compromised hosts.(Citation: FireEye NETWIRE March 2019)
iKitten	iKitten lists the current processes running.(Citation: objsee mac malware 2017)
Tasklist	Tasklist can be used to discover processes running on a system.(Citation: Microsoft Tasklist)
Bad Rabbit	Bad Rabbit can enumerate all running processes to compare hashes.(Citation: Secure List Bad Rabbit)
Aria-body	Aria-body has the ability to enumerate loaded modules for a process.(Citation: CheckPoint Naikon May 2020).
Emotet	Emotet has been observed enumerating local processes.(Citation: ASEC Emotet 2017)
Crimson	Crimson contains a command to list processes.(Citation: Proofpoint Operation Transparent Tribe March 2016)(Citation: Kaspersky Transparent Tribe August 2020)(Citation: Cisco Talos Transparent Tribe Education Campaign July 2022)
DUSTTRAP	DUSTTRAP can enumerate running processes.(Citation: Google Cloud APT41 2024)
Empire	Empire can find information about processes running on local and remote systems.(Citation: Github PowerShell Empire)(Citation: Talos Frankenstein June 2019)
BADHATCH	BADHATCH can retrieve a list of running processes from a compromised machine.(Citation: BitDefender BADHATCH Mar 2021)
Machete	Machete has a component to check for running processes to look for web browsers.(Citation: ESET Machete July 2019)
Avenger	Avenger has the ability to use Tasklist to identify running processes.(Citation: Trend Micro Tick November 2019)
PcShare	PcShare can obtain a list of running processes on a compromised host.(Citation: Bitdefender FunnyDream Campaign November 2020)
Dacls	Dacls can collect data on running and parent processes.(Citation: TrendMicro macOS Dacls May 2020)
Woody RAT	Woody RAT can call `NtQuerySystemProcessInformation` with `SystemProcessInformation` to enumerate all running processes, including associated information such as PID, parent PID, image name, and owner.(Citation: MalwareBytes WoodyRAT Aug 2022)
Mafalda	Mafalda can enumerate running processes on a machine.(Citation: SentinelLabs Metador Sept 2022)
ELMER	ELMER is capable of performing process listings.(Citation: FireEye EPS Awakens Part 2)
ShrinkLocker	ShrinkLocker checks whether the Bitlocker Drive Encryption Tools service is running.(Citation: Splunk ShrinkLocker 2024)
SombRAT	SombRAT can use the `getprocesslist` command to enumerate processes on a compromised host.(Citation: BlackBerry CostaRicto November 2020)(Citation: FireEye FiveHands April 2021)(Citation: CISA AR21-126A FIVEHANDS May 2021)
Cuckoo Stealer	Cuckoo Stealer can use `ps aux` to enumerate running processes.(Citation: Kandji Cuckoo April 2024)
MobileOrder	MobileOrder has a command to upload information about all running processes to its C2 server.(Citation: Scarlet Mimic Jan 2016)
InvisiMole	InvisiMole can obtain a list of running processes.(Citation: ESET InvisiMole June 2018)(Citation: ESET InvisiMole June 2020)
Apostle	Apostle retrieves a list of all running processes on a victim host, and stops all services containing the string "sql," likely to propagate ransomware activity to database files.(Citation: SentinelOne Agrius 2021)
Volgmer	Volgmer can gather a list of processes.(Citation: Symantec Volgmer Aug 2014)
WINERACK	WINERACK can enumerate processes.(Citation: FireEye APT37 Feb 2018)
FruitFly	FruitFly has the ability to list processes on the system.(Citation: objsee mac malware 2017)
Skidmap	Skidmap has monitored critical processes to ensure resiliency.(Citation: Trend Micro Skidmap)
Bonadan	Bonadan can use the `ps` command to discover other cryptocurrency miners active on the system.(Citation: ESET ForSSHe December 2018)
Conti	Conti can enumerate through all open processes to search for any that have the string “sql” in their process name.(Citation: CarbonBlack Conti July 2020)
Raspberry Robin	Raspberry Robin can identify processes running on the victim machine, such as security software, during execution.(Citation: TrendMicro RaspberryRobin 2022)(Citation: HP RaspberryRobin 2024)
Mispadu	Mispadu can enumerate the running processes on a compromised host.(Citation: ESET Security Mispadu Facebook Ads 2019)
Megazord	Megazord can terminate a list of specified services and processes.(Citation: Palo Alto Howling Scorpius DEC 2024)
Diavol	Diavol has used `CreateToolhelp32Snapshot`, `Process32First`, and `Process32Next` API calls to enumerate the running processes in the system.(Citation: Fortinet Diavol July 2021)
Doki	Doki has searched for the current process’s PID.(Citation: Intezer Doki July 20)
Fysbis	Fysbis can collect information about running processes.(Citation: Fysbis Dr Web Analysis)
VERMIN	VERMIN can get a list of the processes and running tasks on the system.(Citation: Unit 42 VERMIN Jan 2018)
UBoatRAT	UBoatRAT can list running processes on the system.(Citation: PaloAlto UBoatRAT Nov 2017)
Nightdoor	Nightdoor can collect information on installed applications via Windows registry keys, as well as collecting information on running processes.(Citation: ESET EvasivePanda 2024)
MarkiRAT	MarkiRAT can search for different processes on a system.(Citation: Kaspersky Ferocious Kitten Jun 2021)
PowerShower	PowerShower has the ability to deploy a reconnaissance module to retrieve a list of the active processes.(Citation: Kaspersky Cloud Atlas August 2019)
Kazuar	Kazuar obtains a list of running processes through WMI querying and the `ps` command.(Citation: Unit 42 Kazuar May 2017)
NavRAT	NavRAT uses `tasklist /v` to check running processes.(Citation: Talos NavRAT May 2018)
DarkComet	DarkComet can list active processes running on the victim’s machine.(Citation: Malwarebytes DarkComet March 2018)
NETEAGLE	NETEAGLE can send process listings over the C2 channel.(Citation: FireEye APT30)
POORAIM	POORAIM can enumerate processes.(Citation: FireEye APT37 Feb 2018)
CHIMNEYSWEEP	CHIMNEYSWEEP can check if a process name contains “creensaver.”(Citation: Mandiant ROADSWEEP August 2022)
FatDuke	FatDuke can list running processes on the localhost.(Citation: ESET Dukes October 2019)
Lucifer	Lucifer can identify the process that owns remote connections.(Citation: Unit 42 Lucifer June 2020)
BlackEnergy	BlackEnergy has gathered a process list by using Tasklist.exe.(Citation: F-Secure BlackEnergy 2014)(Citation: Securelist BlackEnergy Nov 2014)(Citation: ESET BlackEnergy Jan 2016)
DRATzarus	DRATzarus can enumerate and examine running processes to determine if a debugger is present.(Citation: ClearSky Lazarus Aug 2020)
Rising Sun	Rising Sun can enumerate all running processes and process information on an infected machine.(Citation: McAfee Sharpshooter December 2018)
ObliqueRAT	ObliqueRAT can check for blocklisted process names on a compromised host.(Citation: Talos Oblique RAT March 2021)
SHOTPUT	SHOTPUT has a command to obtain a process listing.(Citation: Palo Alto CVE-2015-3113 July 2015)
Avaddon	Avaddon has collected information about running processes.(Citation: Arxiv Avaddon Feb 2021)
SocGholish	SocGholish can list processes on targeted hosts.(Citation: Secureworks Gold Prelude Profile)
Flagpro	Flagpro has been used to run the `tasklist` command on a compromised system.(Citation: NTT Security Flagpro new December 2021)
XAgentOSX	XAgentOSX contains the getProcessList function to run `ps aux` to get running processes.(Citation: XAgentOSX 2017)
LightSpy	If sent the command `16002`, LightSpy uses the `NSWorkspace runningApplications()` method to collect the process ID, path to the executable, bundle information, and the filename of the executable for all running applications.(Citation: Huntress LightSpy macOS 2024)
HELLOKITTY	HELLOKITTY can search for specific processes to terminate.(Citation: FireEye FiveHands April 2021)
DarkTortilla	DarkTortilla can enumerate a list of running processes on a compromised system.(Citation: Secureworks DarkTortilla Aug 2022)
ROKRAT	ROKRAT can list the current running processes on the system.(Citation: Talos ROKRAT)(Citation: NCCGroup RokRat Nov 2018)
Babuk	Babuk has the ability to check running processes on a targeted system.(Citation: Sogeti CERT ESEC Babuk March 2021)(Citation: McAfee Babuk February 2021)(Citation: Trend Micro Ransomware February 2021)
Javali	Javali can monitor processes for open browsers and custom banking applications.(Citation: Securelist Brazilian Banking Malware July 2020)
BBSRAT	BBSRAT can list running processes.(Citation: Palo Alto Networks BBSRAT)
PlugX	PlugX has a module to list the processes running on a machine.(Citation: CIRCL PlugX March 2013)
Bisonal	Bisonal can obtain a list of running processes on the victim’s machine.(Citation: Unit 42 Bisonal July 2018)(Citation: Kaspersky CactusPete Aug 2020)(Citation: Talos Bisonal Mar 2020)
DustySky	DustySky collects information about running processes from victims.(Citation: DustySky)(Citation: Kaspersky MoleRATs April 2019)
Duqu	The discovery modules used with Duqu can collect information on process details.(Citation: Symantec W32.Duqu)
Remsec	Remsec can obtain a process list from the victim.(Citation: Kaspersky ProjectSauron Technical Analysis)
Industroyer2	Industroyer2 has the ability to cyclically enumerate running processes such as PServiceControl.exe, PService_PDD.exe, and other targets supplied through a hardcoded configuration.(Citation: Industroyer2 Mandiant April 2022)
Sykipot	Sykipot may gather a list of running processes by running `tasklist /v`.(Citation: AlienVault Sykipot 2011)
AsyncRAT	AsyncRAT can examine running processes to determine if a debugger is present.(Citation: Telefonica Snip3 December 2021)
Epic	Epic uses the `tasklist /v` command to obtain a list of processes.(Citation: Kaspersky Turla)(Citation: Kaspersky Turla Aug 2014)
Cuba	Cuba can enumerate processes running on a victim's machine.(Citation: McAfee Cuba April 2021)
Clambling	Clambling can enumerate processes on a targeted system.(Citation: Trend Micro DRBControl February 2020)
Agent Tesla	Agent Tesla can list the current running processes on the system.(Citation: Fortinet Agent Tesla June 2017)
Akira	Akira verifies the deletion of volume shadow copies by checking for the existence of the process ID related to the process created to delete these items.(Citation: Kersten Akira 2023)
DarkGate	DarkGate performs various checks for running processes, including security software by looking for hard-coded process name values.(Citation: Ensilo Darkgate 2018)(Citation: Rapid7 BlackBasta 2024)
LockBit 3.0	LockBit 3.0 can identify and terminate specific services.(Citation: Sentinel Labs LockBit 3.0 JUL 2022)(Citation: Joint Cybersecurity Advisory LockBit JUN 2023)
SVCReady	SVCReady can collect a list of running processes from an infected host.(Citation: HP SVCReady Jun 2022)
ThiefQuest	ThiefQuest obtains a list of running processes using the function `kill_unwanted`.(Citation: wardle evilquest parti)
FoggyWeb	FoggyWeb's loader can enumerate all Common Language Runtimes (CLRs) and running Application Domains in the compromised AD FS server's `Microsoft.IdentityServer.ServiceHost.exe` process.(Citation: MSTIC FoggyWeb September 2021)
Carbanak	Carbanak lists running processes.(Citation: FireEye CARBANAK June 2017)
Hydraq	Hydraq creates a backdoor through which remote attackers can monitor processes.(Citation: Symantec Trojan.Hydraq Jan 2010)(Citation: Symantec Hydraq Jan 2010)
Caterpillar WebShell	Caterpillar WebShell can gather a list of processes running on the machine.(Citation: ClearSky Lebanese Cedar Jan 2021)
Elise	Elise enumerates processes via the `tasklist` command.(Citation: Accenture Dragonfish Jan 2018)
USBferry	USBferry can use `tasklist` to gather information about the process running on the infected system.(Citation: TrendMicro Tropic Trooper May 2020)
Brute Ratel C4	Brute Ratel C4 can enumerate all processes and locate specific process IDs (PIDs).(Citation: Palo Alto Brute Ratel July 2022)
TSCookie	TSCookie has the ability to list processes on the infected host.(Citation: JPCert TSCookie March 2018)
Latrodectus	Latrodectus can enumerate running processes including process grandchildren on targeted hosts.(Citation: Latrodectus APR 2024)(Citation: Elastic Latrodectus May 2024)(Citation: Bitsight Latrodectus June 2024)
Saint Bot	Saint Bot has enumerated running processes on a compromised host to determine if it is running under the process name `dfrgui.exe`.(Citation: Palo Alto Unit 42 OutSteel SaintBot February 2022 )
CharmPower	CharmPower has the ability to list running processes through the use of `tasklist`.(Citation: Check Point APT35 CharmPower January 2022)
Bundlore	Bundlore has used the `ps` command to list processes.(Citation: MacKeeper Bundlore Apr 2019)
P8RAT	P8RAT can check for specific processes associated with virtual environments.(Citation: Securelist APT10 March 2021)
Sagerunex	Sagerunex identifies the `explorer.exe` process on the executing system.(Citation: Symantec Bilbug 2022)
TAINTEDSCRIBE	TAINTEDSCRIBE can execute `ProcessList` for process discovery.(Citation: CISA MAR-10288834-2.v1 TAINTEDSCRIBE MAY 2020)
Royal	Royal can use `GetCurrentProcess` to enumerate processes.(Citation: Cybereason Royal December 2022)
Uroburos	Uroburos can use its `Process List` command to enumerate processes on compromised hosts.(Citation: Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023)
Metamorfo	Metamorfo has performed process name checks and has monitored applications.(Citation: Medium Metamorfo Apr 2020)
Trojan.Karagany	Trojan.Karagany can use Tasklist to collect a list of running tasks.(Citation: Symantec Dragonfly)(Citation: Secureworks Karagany July 2019)
PipeMon	PipeMon can iterate over the running processes to find a suitable injection target.(Citation: ESET PipeMon May 2020)
KONNI	KONNI has used the command `cmd /c tasklist` to get a snapshot of the current processes on the target machine.(Citation: Medium KONNI Jan 2020)(Citation: Malwarebytes Konni Aug 2021)
gh0st RAT	gh0st RAT has the capability to list processes.(Citation: FireEye Hacking Team)
JHUHUGIT	JHUHUGIT obtains a list of running processes on the victim.(Citation: ESET Sednit Part 1)(Citation: Unit 42 Sofacy Feb 2018)
BLUELIGHT	BLUELIGHT can collect process filenames and SID authority level.(Citation: Volexity InkySquid BLUELIGHT August 2021)
down_new	down_new has the ability to list running processes on a compromised host.(Citation: Trend Micro Tick November 2019)
Ixeshe	Ixeshe can list running processes.(Citation: Trend Micro IXESHE 2012)
4H RAT	4H RAT has the capability to obtain a listing of running processes (including loaded modules).(Citation: CrowdStrike Putter Panda)
RogueRobin	RogueRobin checks the running processes for evidence it may be running in a sandbox environment. It specifically enumerates processes for Wireshark and Sysinternals.(Citation: Unit 42 DarkHydrus July 2018)
Imminent Monitor	Imminent Monitor has a "Process Watcher" feature to monitor processes in case the client ever crashes or gets closed.(Citation: Imminent Unit42 Dec2019)
StreamEx	StreamEx has the ability to enumerate processes.(Citation: Cylance Shell Crew Feb 2017)
NightClub	NightClub has the ability to use `GetWindowThreadProcessId` to identify the process behind a specified window.(Citation: MoustachedBouncer ESET August 2023)
SDBbot	SDBbot can enumerate a list of running processes on a compromised machine.(Citation: Korean FSI TA505 2020)
Mosquito	Mosquito runs `tasklist` to obtain running processes.(Citation: ESET Turla Mosquito Jan 2018)
RTM	RTM can obtain information about process integrity levels.(Citation: ESET RTM Feb 2017)
Derusbi	Derusbi collects current and parent process IDs.(Citation: Fidelis Turbo)(Citation: FireEye Periscope March 2018)
SodaMaster	SodaMaster can search a list of running processes.(Citation: Securelist APT10 March 2021)
Grandoreiro	Grandoreiro can identify installed security tools based on process names.(Citation: ESET Grandoreiro April 2020)
ZxxZ	ZxxZ has created a snapshot of running processes using `CreateToolhelp32Snapshot`.(Citation: Cisco Talos Bitter Bangladesh May 2022)
Bazar	Bazar can identity the current process on a compromised host.(Citation: Cybereason Bazar July 2020)
RATANKBA	RATANKBA lists the system’s processes.(Citation: Lazarus RATANKBA)(Citation: RATANKBA)
MoonWind	MoonWind has a command to return a list of running processes.(Citation: Palo Alto MoonWind March 2017)
Ryuk	Ryuk has called `CreateToolhelp32Snapshot` to enumerate all running processes.(Citation: CrowdStrike Ryuk January 2019)
Final1stspy	Final1stspy obtains a list of running processes.(Citation: Unit 42 Nokki Oct 2018)
MgBot	MgBot includes a module for establishing a process watchdog for itself, identifying if the MgBot process is still running.(Citation: Symantec Daggerfly 2023)
LockBit 2.0	LockBit 2.0 can determine if a running process has administrative privileges and terminate processes that interfere with encryption or exfiltration.(Citation: FBI Lockbit 2.0 FEB 2022)(Citation: SentinelOne LockBit 2.0)
Zebrocy	Zebrocy uses the `tasklist` and `wmic process get Capture, ExecutablePath` commands to gather the processes running on the system.(Citation: Unit42 Cannon Nov 2018)(Citation: ESET Zebrocy Nov 2018)(Citation: Unit42 Sofacy Dec 2018)(Citation: ESET Zebrocy May 2019)(Citation: Accenture SNAKEMACKEREL Nov 2018)
Pandora	Pandora can monitor processes on a compromised host.(Citation: Trend Micro Iron Tiger April 2021)
FinFisher	FinFisher checks its parent process for indications that it is running in a sandbox setup.(Citation: FinFisher Citation)(Citation: Microsoft FinFisher March 2018)
Cobalt Strike	Cobalt Strike's Beacon payload can collect information on process details.(Citation: cobaltstrike manual)(Citation: Talos Cobalt Strike September 2020)(Citation: Cobalt Strike Manual 4.3 November 2020)
Cobalt Strike	Cobalt Strike's "beacon" payload can collect information on process details.(Citation: cobaltstrike manual)
Donut	Donut includes subprojects that enumerate and identify information about Process Injection candidates.(Citation: Donut Github)
SUNBURST	SUNBURST collected a list of process names that were hashed using a FNV-1a + XOR algorithm to check against similarly-hashed hardcoded blocklists.(Citation: FireEye SUNBURST Backdoor December 2020)
EvilBunny	EvilBunny has used EnumProcesses() to identify how many process are running in the environment.(Citation: Cyphort EvilBunny Dec 2014)
HotCroissant	HotCroissant has the ability to list running processes on the infected host.(Citation: Carbon Black HotCroissant April 2020)
Valak	Valak has the ability to enumerate running processes on a compromised host.(Citation: Cybereason Valak May 2020)
Taidoor	Taidoor can use `GetCurrentProcessId` for process discovery.(Citation: CISA MAR-10292089-1.v2 TAIDOOR August 2021)
IronNetInjector	IronNetInjector can identify processes via C# methods such as `GetProcessesByName` and running Tasklist with the Python `os.popen` function.(Citation: Unit 42 IronNetInjector February 2021 )
CaddyWiper	CaddyWiper can obtain a list of current processes.(Citation: Malwarebytes IssacWiper CaddyWiper March 2022 )
Cyclops Blink	Cyclops Blink can enumerate the process it is currently running under.(Citation: NCSC Cyclops Blink February 2022)
Seasalt	Seasalt has a command to perform a process listing.(Citation: Mandiant APT1 Appendix)
TajMahal	TajMahal has the ability to identify running processes and associated plugins on an infected host.(Citation: Kaspersky TajMahal April 2019)
Pasam	Pasam creates a backdoor through which remote attackers can retrieve lists of running processes.(Citation: Symantec Pasam May 2012)
PLEAD	PLEAD has the ability to list processes on the compromised host.(Citation: TrendMicro BlackTech June 2017)
IPsec Helper	IPsec Helper can identify the process it is currently running under and its number, and pass this back to a command and control node.(Citation: SentinelOne Agrius 2021)
Carbon	Carbon can list the processes on the victim’s machine.(Citation: ESET Carbon Mar 2017)
Cardinal RAT	Cardinal RAT contains watchdog functionality that ensures its process is always running, else spawns a new instance.(Citation: PaloAlto CardinalRat Apr 2017)
BISCUIT	BISCUIT has a command to enumerate running processes and identify their owners.(Citation: Mandiant APT1 Appendix)
Gold Dragon	Gold Dragon checks the running processes on the victim’s machine.(Citation: McAfee Gold Dragon)
Ramsay	Ramsay can gather a list of running processes by using Tasklist.(Citation: Antiy CERT Ramsay April 2020)
Carberp	Carberp has collected a list of running processes.(Citation: Trusteer Carberp October 2010)
NKAbuse	NKAbuse will check victim systems to ensure only one copy of the malware is running.(Citation: NKAbuse SL)
Pillowmint	Pillowmint can iterate through running processes every six seconds collecting a list of processes to capture from later.(Citation: Trustwave Pillowmint June 2020)
MacMa	MacMa can enumerate running processes.(Citation: ESET DazzleSpy Jan 2022)
FunnyDream	FunnyDream has the ability to discover processes, including `Bka.exe` and `BkavUtil.exe`.(Citation: Bitdefender FunnyDream Campaign November 2020)
SUNSPOT	SUNSPOT monitored running processes for instances of `MsBuild.exe` by hashing the name of each running process and comparing it to the corresponding value `0x53D525`. It also extracted command-line arguments and individual arguments from the running `MsBuild.exe` process to identify the directory path of the Orion software Visual Studio solution.(Citation: CrowdStrike SUNSPOT Implant January 2021)
SysUpdate	SysUpdate can collect information about running processes.(Citation: Lunghi Iron Tiger Linux)
OutSteel	OutSteel can identify running processes on a compromised host.(Citation: Palo Alto Unit 42 OutSteel SaintBot February 2022 )
Kwampirs	Kwampirs collects a list of running services with the command `tasklist /v`.(Citation: Symantec Orangeworm April 2018)
LookBack	LookBack can list running processes.(Citation: Proofpoint LookBack Malware Aug 2019)
Clop	Clop can enumerate all processes on the victim's machine.(Citation: Mcafee Clop Aug 2019)
Pupy	Pupy can list the running processes and get the process ID and parent process’s ID.(Citation: GitHub Pupy)
PoetRAT	PoetRAT has the ability to list all running processes.(Citation: Talos PoetRAT April 2020)
FELIXROOT	FELIXROOT collects a list of running processes.(Citation: ESET GreyEnergy Oct 2018)
ZxShell	ZxShell has a command, ps, to obtain a listing of processes on the system.(Citation: Talos ZxShell Oct 2014)
BabyShark	BabyShark has executed the `tasklist` command.(Citation: Unit42 BabyShark Feb 2019)
Cannon	Cannon can obtain a list of processes running on the system.(Citation: Unit42 Cannon Nov 2018)(Citation: Unit42 Sofacy Dec 2018)
Winnti for Windows	Winnti for Windows can check if the explorer.exe process is responsible for calling its install function.(Citation: Novetta Winnti April 2015)
BLACKCOFFEE	BLACKCOFFEE has the capability to discover processes.(Citation: FireEye APT17)
Kinsing	Kinsing has used ps to list processes.(Citation: Aqua Kinsing April 2020)
Meteor	Meteor can check if a specific process is running, such as Kaspersky's `avp.exe`.(Citation: Check Point Meteor Aug 2021)
njRAT	njRAT can search a list of running processes for Tr.exe.(Citation: Trend Micro njRAT 2018)
ZIPLINE	ZIPLINE can identify running processes and their names.(Citation: Mandiant Cutting Edge January 2024)
Maze	Maze has gathered all of the running system processes.(Citation: McAfee Maze March 2020)
ChChes	ChChes collects its process identifier (PID) on the victim.(Citation: Palo Alto menuPass Feb 2017)
PowerStallion	PowerStallion has been used to monitor process lists.(Citation: ESET Turla PowerShell May 2019)
POWERSTATS	POWERSTATS has used `get_tasklist` to discover processes on the compromised host.(Citation: TrendMicro POWERSTATS V3 June 2019)
JPIN	JPIN can list running processes.(Citation: Microsoft PLATINUM April 2016)
metaMain	metaMain can enumerate the processes that run on the platform.(Citation: SentinelLabs Metador Sept 2022)(Citation: SentinelLabs Metador Technical Appendix Sept 2022)
Heyoka Backdoor	Heyoka Backdoor can gather process information.(Citation: SentinelOne Aoqin Dragon June 2022)
LunarWeb	LunarWeb has used shell commands to list running processes.(Citation: ESET Turla Lunar toolset May 2024)
KillDisk	KillDisk has called `GetCurrentProcess`.(Citation: Trend Micro KillDisk 2)
SoreFang	SoreFang can enumerate processes on a victim machine through use of Tasklist.(Citation: CISA SoreFang July 2016)
Socksbot	Socksbot can list all running processes.(Citation: TrendMicro Patchwork Dec 2017)
Linfo	Linfo creates a backdoor through which remote attackers can retrieve a list of running processes.(Citation: Symantec Linfo May 2012)
Goopy	Goopy has checked for the Google Updater process to ensure Goopy was loaded properly.(Citation: Cybereason Cobalt Kitty 2017)
ShadowPad	ShadowPad has collected the PID of a malicious process.(Citation: Kaspersky ShadowPad Aug 2017)
Astaroth	Astaroth searches for different processes on the system.(Citation: Cybereason Astaroth Feb 2019)
QakBot	QakBot has the ability to check running processes.(Citation: ATT QakBot April 2021)
SYSCON	SYSCON has the ability to use Tasklist to list running processes.(Citation: Unit 42 CARROTBAT January 2020)
Gelsemium	Gelsemium can enumerate running processes.(Citation: ESET Gelsemium June 2021)
jRAT	jRAT can query and kill system processes.(Citation: Symantec Frutas Feb 2013)
Helminth	Helminth has used Tasklist to get information on processes.(Citation: Unit 42 Playbook Dec 2017)
Komplex	The OsInfo function in Komplex collects a running process list.(Citation: Sofacy Komplex Trojan)
INC Ransomware	INC Ransomware can use the Microsoft Win32 Restart Manager to kill processes with a specific handle or that are accessing resources it wants to encrypt.(Citation: Cybereason INC Ransomware November 2023)
Waterbear	Waterbear can identify the process for a specific security product.(Citation: Trend Micro Waterbear December 2019)
Comnie	Comnie uses the `tasklist` to view running processes on the victim’s machine.(Citation: Palo Alto Comnie)
Lizar	Lizar has a plugin designed to obtain a list of processes.(Citation: Threatpost Lizar May 2021)(Citation: BiZone Lizar May 2021)
Dtrack	Dtrack’s dropper can list all running processes.(Citation: Securelist Dtrack)(Citation: CyberBit Dtrack)
LoudMiner	LoudMiner used the `ps` command to monitor the running processes on the system.(Citation: ESET LoudMiner June 2019)
Azorult	Azorult can collect a list of running processes by calling CreateToolhelp32Snapshot.(Citation: Unit42 Azorult Nov 2018)(Citation: Proofpoint Azorult July 2018)
BACKSPACE	BACKSPACE may collect information about running processes.(Citation: FireEye APT30)
Zox	Zox has the ability to list processes.(Citation: Novetta-Axiom)
ADVSTORESHELL	ADVSTORESHELL can list running processes.(Citation: ESET Sednit Part 2)
WarzoneRAT	WarzoneRAT can obtain a list of processes on a compromised host.(Citation: Check Point Warzone Feb 2020)
SLOTHFULMEDIA	SLOTHFULMEDIA has enumerated processes by ID, name, or privileges.(Citation: CISA MAR SLOTHFULMEDIA October 2020)
Frankenstein	Frankenstein has enumerated hosts, looking to obtain a list of all currently running processes.(Citation: Talos Frankenstein June 2019)
APT28	An APT28 loader Trojan will enumerate the victim's processes searching for explorer.exe if its current process does not have necessary permissions.(Citation: Unit 42 Playbook Dec 2017)
Turla	Turla surveys a system upon check-in to discover running processes using the `tasklist /v` command.(Citation: Kaspersky Turla) Turla RPC backdoors have also enumerated processes associated with specific open ports or named pipes.(Citation: ESET Turla PowerShell May 2019)
Tropic Trooper	Tropic Trooper is capable of enumerating the running processes on the system using `pslist`.(Citation: Unit 42 Tropic Trooper Nov 2016)(Citation: TrendMicro Tropic Trooper May 2020)
Operation Wocao	Operation Wocao has collected a list of running processes on the infected system.(Citation: FoxIT Wocao December 2019)
Lazarus Group	Several Lazarus Group malware families gather a list of running processes on a victim system and send it to their C2 server. A Destover-like variant used by Lazarus Group also gathers process times.(Citation: Novetta Blockbuster)(Citation: Novetta Blockbuster Loaders)(Citation: McAfee Lazarus Resurfaces Feb 2018)(Citation: McAfee GhostSecret)(Citation: TrendMicro macOS Dacls May 2020)(Citation: Lazarus APT January 2022)
Gamaredon Group	Gamaredon Group has used tools to enumerate processes on target hosts including Process Explorer.(Citation: Symantec Shuckworm January 2022)(Citation: Unit 42 Gamaredon February 2022)
APT29	APT29 has used multiple command-line utilities to enumerate running processes.(Citation: Volexity SolarWinds)(Citation: Microsoft Deep Dive Solorigate January 2021)(Citation: CrowdStrike StellarParticle January 2022)
Darkhotel	Darkhotel malware can collect a list of running processes on a system.(Citation: Securelist Darkhotel Aug 2015)
APT1	APT1 gathered a list of running processes on the system using `tasklist /v`.(Citation: Mandiant APT1)
APT38	APT38 leveraged Sysmon to understand the processes, services in the organization.(Citation: FireEye APT38 Oct 2018)
MuddyWater	MuddyWater has used malware to obtain a list of running processes on the system.(Citation: Securelist MuddyWater Oct 2018)(Citation: ClearSky MuddyWater June 2019)
Rocke	Rocke can detect a running process's PID on the infected machine.(Citation: Anomali Rocke March 2019)
Honeybee	Honeybee gathers a list of processes using the `tasklist` command and then is sent back to the control server.(Citation: McAfee Honeybee)
Molerats	Molerats actors obtained a list of active processes on the victim and sent them to C2 servers.(Citation: DustySky)
Poseidon Group	After compromising a victim, Poseidon Group lists all running processes.(Citation: Kaspersky Poseidon Group)
Higaisa	Higaisa’s shellcode attempted to find the process ID of the current process.(Citation: Zscaler Higaisa 2020)
Sidewinder	Sidewinder has used tools to identify running processes on the victim's machine.(Citation: ATT Sidewinder January 2021)
Deep Panda	Deep Panda uses the Microsoft Tasklist utility to list processes running on systems.(Citation: Alperovitch 2014)
OilRig	OilRig has run `tasklist` on a victim's machine and used infostealers to capture processes.(Citation: Palo Alto OilRig May 2016)(Citation: Symantec Crambus OCT 2023)
APT37	APT37's Freenki malware lists running processes using the Microsoft Windows API.(Citation: Talos Group123)
Inception	Inception has used a reconnaissance module to identify active processes and other associated loaded modules.(Citation: Symantec Inception Framework March 2018)
Chimera	Chimera has used `tasklist` to enumerate processes.(Citation: NCC Group Chimera January 2021)
HEXANE	HEXANE has enumerated processes on targeted systems.(Citation: Kaspersky Lyceum October 2021)
Andariel	Andariel has used `tasklist` to enumerate processes and find a specific string.(Citation: Kaspersky Andariel Ransomware June 2021)
Volt Typhoon	Volt Typhoon has enumerated running processes on targeted systems including through the use of Tasklist.(Citation: Microsoft Volt Typhoon May 2023)(Citation: Secureworks BRONZE SILHOUETTE May 2023)(Citation: CISA AA24-038A PRC Critical Infrastructure February 2024)
Kimsuky	Kimsuky can gather a list of all processes running on a victim's machine.(Citation: Talos Kimsuky Nov 2021)
Magic Hound	Magic Hound malware can list running processes.(Citation: Unit 42 Magic Hound Feb 2017)
Winnti Group	Winnti Group looked for a specific process running on infected servers.(Citation: Kaspersky Winnti April 2013)
TeamTNT	TeamTNT has searched for rival malware and removes it if found.(Citation: Trend Micro TeamTNT) TeamTNT has also searched for running processes containing the strings aliyun or liyun to identify machines running Alibaba Cloud Security tools.(Citation: Cisco Talos Intelligence Group)
ToddyCat	ToddyCat has run `cmd /c start /b tasklist` to enumerate processes.(Citation: Kaspersky ToddyCat Check Logs October 2023)
Ke3chang	Ke3chang performs process discovery using `tasklist` commands.(Citation: Mandiant Operation Ke3chang November 2014)(Citation: NCC Group APT15 Alive and Strong)
Windshift	Windshift has used malware to enumerate active processes.(Citation: BlackBerry Bahamut)
APT5	APT5 has used Windows-based utilities to carry out tasks including tasklist.exe. (Citation: Mandiant Pulse Secure Update May 2021)
Mustang Panda	Mustang Panda has used `tasklist /v` to determine active process information.(Citation: Avira Mustang Panda January 2020)
Play	Play has used the information stealer Grixba to check for a list of security processes.(Citation: Trend Micro Ransomware Spotlight Play July 2023)
APT3	APT3 has a tool that can list out currently running processes.(Citation: FireEye Clandestine Fox)(Citation: evolution of pirpi)
Earth Lusca	Earth Lusca has used Tasklist to obtain information from a compromised host.(Citation: TrendMicro EarthLusca 2022)
UNC2452	UNC2452 used multiple command-line utilities to enumerate running processes.(Citation: Volexity SolarWinds)(Citation: Microsoft Deep Dive Solorigate January 2021)
HAFNIUM	HAFNIUM has used `tasklist` to enumerate processes.(Citation: Rapid7 HAFNIUM Mar 2021)
Stealth Falcon	Stealth Falcon malware gathers a list of running processes.(Citation: Citizen Lab Stealth Falcon May 2016)

Mitigation	Description
Mitigations
Process Discovery Mitigation	Identify unnecessary system utilities or potentially malicious software that may be used to acquire information about processes, and audit and/or block them by using whitelisting (Citation: Beechey 2010) tools, like AppLocker, (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) or Software Restriction Policies (Citation: Corio 2008) where appropriate. (Citation: TechNet Applocker vs SRP)

Detection

System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as Lateral Movement, based on the information obtained. Normal, benign system and network events that look like process discovery may be uncommon, depending on the environment and how they are used. Monitor processes and command-line arguments for actions that could be taken to gather system and network information. Remote access tools with built-in features may interact directly with the Windows API to gather information. Information may also be acquired through Windows system management tools such as Windows Management Instrumentation and PowerShell. For network infrastructure devices, collect AAA logging to monitor for `show` commands being run by non-standard users from non-standard locations.

References

Связанные риски

Ничего не найдено

Каталоги

Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.

Process Discovery

Procedure Examples

Mitigations

Detection

References

Связанные риски

Каталоги