MITRE ATT&CK - Техника Исследование процессов

Куда я попал?

SECURITM это SGRC система, автоматизирующая процессы в службах информационной безопасности. SECURITM помогает построить и управлять ИСПДн, КИИ, ГИС, СМИБ/СУИБ, банковскими системами защиты.
А еще SECURITM это место для обмена опытом и наработками для служб безопасности.

Подробнее

Наш канал

Исследование процессов

Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. In Windows environments, adversaries could obtain details on running processes using the Tasklist utility via cmd or Get-Process via PowerShell. Information about processes can also be extracted from the output of Native API calls such as CreateToolhelp32Snapshot. In Mac and Linux, this is accomplished with the ps command. Adversaries may also opt to enumerate processes via /proc.

ID: T1057

Тактика(-и): Discovery

Платформы: Linux, macOS, Windows

Требуемые разрешения: Administrator, SYSTEM, User

Источники данных: Command: Command Execution, Process: OS API Execution, Process: Process Creation

Версия: 1.2

Дата создания: 31 May 2017

Последнее изменение: 26 Mar 2020

Название	Описание
Примеры процедур
Epic	Epic uses the `tasklist /v` command to obtain a list of processes.(Citation: Kaspersky Turla)(Citation: Kaspersky Turla Aug 2014)
WarzoneRAT	WarzoneRAT can obtain a list of processes on a compromised host.(Citation: Check Point Warzone Feb 2020)
FELIXROOT	FELIXROOT collects a list of running processes.(Citation: ESET GreyEnergy Oct 2018)
	During Frankenstein, the threat actors used Empire to obtain a list of all running processes.(Citation: Talos Frankenstein June 2019)
Windshift	Windshift has used malware to enumerate active processes.(Citation: BlackBerry Bahamut)
SUNSPOT	SUNSPOT monitored running processes for instances of `MsBuild.exe` by hashing the name of each running process and comparing it to the corresponding value `0x53D525`. It also extracted command-line arguments and individual arguments from the running `MsBuild.exe` process to identify the directory path of the Orion software Visual Studio solution.(Citation: CrowdStrike SUNSPOT Implant January 2021)
StreamEx	StreamEx has the ability to enumerate processes.(Citation: Cylance Shell Crew Feb 2017)
Aria-body	Aria-body has the ability to enumerate loaded modules for a process.(Citation: CheckPoint Naikon May 2020).
MoonWind	MoonWind has a command to return a list of running processes.(Citation: Palo Alto MoonWind March 2017)
Zebrocy	Zebrocy uses the `tasklist` and `wmic process get Capture, ExecutablePath` commands to gather the processes running on the system.(Citation: Unit42 Cannon Nov 2018)(Citation: ESET Zebrocy Nov 2018)(Citation: Unit42 Sofacy Dec 2018)(Citation: ESET Zebrocy May 2019)(Citation: Accenture SNAKEMACKEREL Nov 2018)
IronNetInjector	IronNetInjector can identify processes via C# methods such as `GetProcessesByName` and running Tasklist with the Python `os.popen` function.(Citation: Unit 42 IronNetInjector February 2021 )
FruitFly	FruitFly has the ability to list processes on the system.(Citation: objsee mac malware 2017)
Cannon	Cannon can obtain a list of processes running on the system.(Citation: Unit42 Cannon Nov 2018)(Citation: Unit42 Sofacy Dec 2018)
LoudMiner	LoudMiner used the `ps` command to monitor the running processes on the system.(Citation: ESET LoudMiner June 2019)
WinMM	WinMM sets a WH_CBT Windows hook to collect information on process creation.(Citation: Baumgartner Naikon 2015)
ZxxZ	ZxxZ has created a snapshot of running processes using `CreateToolhelp32Snapshot`.(Citation: Cisco Talos Bitter Bangladesh May 2022)
Grandoreiro	Grandoreiro can identify installed security tools based on process names.(Citation: ESET Grandoreiro April 2020)
KEYMARBLE	KEYMARBLE can obtain a list of running processes on the system.(Citation: US-CERT KEYMARBLE Aug 2018)
WINERACK	WINERACK can enumerate processes.(Citation: FireEye APT37 Feb 2018)
NETEAGLE	NETEAGLE can send process listings over the C2 channel.(Citation: FireEye APT30)
Tropic Trooper	Tropic Trooper is capable of enumerating the running processes on the system using `pslist`.(Citation: Unit 42 Tropic Trooper Nov 2016)(Citation: TrendMicro Tropic Trooper May 2020)
SombRAT	SombRAT can use the `getprocesslist` command to enumerate processes on a compromised host.(Citation: BlackBerry CostaRicto November 2020)(Citation: FireEye FiveHands April 2021)(Citation: CISA AR21-126A FIVEHANDS May 2021)
Ryuk	Ryuk has called `CreateToolhelp32Snapshot` to enumerate all running processes.(Citation: CrowdStrike Ryuk January 2019)
JHUHUGIT	JHUHUGIT obtains a list of running processes on the victim.(Citation: ESET Sednit Part 1)(Citation: Unit 42 Sofacy Feb 2018)
Bisonal	Bisonal can obtain a list of running processes on the victim’s machine.(Citation: Unit 42 Bisonal July 2018)(Citation: Kaspersky CactusPete Aug 2020)(Citation: Talos Bisonal Mar 2020)
Valak	Valak has the ability to enumerate running processes on a compromised host.(Citation: Cybereason Valak May 2020)
TSCookie	TSCookie has the ability to list processes on the infected host.(Citation: JPCert TSCookie March 2018)
PcShare	PcShare can obtain a list of running processes on a compromised host.(Citation: Bitdefender FunnyDream Campaign November 2020)
Ixeshe	Ixeshe can list running processes.(Citation: Trend Micro IXESHE 2012)
Bundlore	Bundlore has used the `ps` command to list processes.(Citation: MacKeeper Bundlore Apr 2019)
Sidewinder	Sidewinder has used tools to identify running processes on the victim's machine.(Citation: ATT Sidewinder January 2021)
SoreFang	SoreFang can enumerate processes on a victim machine through use of Tasklist.(Citation: CISA SoreFang July 2016)
Orz	Orz can gather a process list from the victim.(Citation: Proofpoint Leviathan Oct 2017)
Deep Panda	Deep Panda uses the Microsoft Tasklist utility to list processes running on systems.(Citation: Alperovitch 2014)
Lucifer	Lucifer can identify the process that owns remote connections.(Citation: Unit 42 Lucifer June 2020)
Machete	Machete has a component to check for running processes to look for web browsers.(Citation: ESET Machete July 2019)
JPIN	JPIN can list running processes.(Citation: Microsoft PLATINUM April 2016)
RCSession	RCSession can identify processes based on PID.(Citation: Profero APT27 December 2020)
EKANS	EKANS looks for processes from a hard-coded list.(Citation: Dragos EKANS)(Citation: FireEye Ransomware Feb 2020)(Citation: IBM Ransomware Trends September 2020)
Cobalt Strike	Cobalt Strike's "beacon" payload can collect information on process details.(Citation: cobaltstrike manual)
BlackEnergy	BlackEnergy has gathered a process list by using Tasklist.exe.(Citation: F-Secure BlackEnergy 2014)(Citation: Securelist BlackEnergy Nov 2014)(Citation: ESET BlackEnergy Jan 2016)
Brave Prince	Brave Prince lists the running processes.(Citation: McAfee Gold Dragon)
Fysbis	Fysbis can collect information about running processes.(Citation: Fysbis Dr Web Analysis)
Remsec	Remsec can obtain a process list from the victim.(Citation: Kaspersky ProjectSauron Technical Analysis)
Diavol	Diavol has used `CreateToolhelp32Snapshot`, `Process32First`, and `Process32Next` API calls to enumerate the running processes in the system.(Citation: Fortinet Diavol July 2021)
Tasklist	Tasklist can be used to discover processes running on a system.(Citation: Microsoft Tasklist)
Caterpillar WebShell	Caterpillar WebShell can gather a list of processes running on the machine.(Citation: ClearSky Lebanese Cedar Jan 2021)
GeminiDuke	GeminiDuke collects information on running processes and environment variables from the victim.(Citation: F-Secure The Dukes)
Astaroth	Astaroth searches for different processes on the system.(Citation: Cybereason Astaroth Feb 2019)
APT29	APT29 has used multiple command-line utilities to enumerate running processes.(Citation: Volexity SolarWinds)(Citation: Microsoft Deep Dive Solorigate January 2021)(Citation: CrowdStrike StellarParticle January 2022)
Bankshot	Bankshot identifies processes and collects the process ids.(Citation: McAfee Bankshot)
APT1	APT1 gathered a list of running processes on the system using `tasklist /v`.(Citation: Mandiant APT1)
Zeus Panda	Zeus Panda checks for running processes on the victim’s machine.(Citation: GDATA Zeus Panda June 2017)
Duqu	The discovery modules used with Duqu can collect information on process details.(Citation: Symantec W32.Duqu)
Comnie	Comnie uses the `tasklist` to view running processes on the victim’s machine.(Citation: Palo Alto Comnie)
Operation Wocao	Operation Wocao has collected a list of running processes on the infected system.(Citation: FoxIT Wocao December 2019)
Dacls	Dacls can collect data on running and parent processes.(Citation: TrendMicro macOS Dacls May 2020)
POWRUNER	POWRUNER may collect process information by running `tasklist` on a victim.(Citation: FireEye APT34 Dec 2017)
TAINTEDSCRIBE	TAINTEDSCRIBE can execute `ProcessList` for process discovery.(Citation: CISA MAR-10288834-2.v1 TAINTEDSCRIBE MAY 2020)
Ursnif	Ursnif has gathered information about running processes.(Citation: TrendMicro Ursnif Mar 2015)(Citation: TrendMicro BKDR_URSNIF.SM)
Agent Tesla	Agent Tesla can list the current running processes on the system.(Citation: Fortinet Agent Tesla June 2017)
Final1stspy	Final1stspy obtains a list of running processes.(Citation: Unit 42 Nokki Oct 2018)
Sykipot	Sykipot may gather a list of running processes by running `tasklist /v`.(Citation: AlienVault Sykipot 2011)
Imminent Monitor	Imminent Monitor has a "Process Watcher" feature to monitor processes in case the client ever crashes or gets closed.(Citation: Imminent Unit42 Dec2019)
PowerShower	PowerShower has the ability to deploy a reconnaissance module to retrieve a list of the active processes.(Citation: Kaspersky Cloud Atlas August 2019)
Darkhotel	Darkhotel malware can collect a list of running processes on a system.(Citation: Securelist Darkhotel Aug 2015)
Elise	Elise enumerates processes via the `tasklist` command.(Citation: Accenture Dragonfish Jan 2018)
AppleSeed	AppleSeed can enumerate the current process on a compromised host.(Citation: Malwarebytes Kimsuky June 2021)
Avenger	Avenger has the ability to use Tasklist to identify running processes.(Citation: Trend Micro Tick November 2019)
PlugX	PlugX has a module to list the processes running on a machine.(Citation: CIRCL PlugX March 2013)
Seasalt	Seasalt has a command to perform a process listing.(Citation: Mandiant APT1 Appendix)
Kasidet	Kasidet has the ability to search for a given process name in processes currently running in the system.(Citation: Zscaler Kasidet)
Stealth Falcon	Stealth Falcon malware gathers a list of running processes.(Citation: Citizen Lab Stealth Falcon May 2016)
TeamTNT	TeamTNT has searched for rival malware and removes it if found.(Citation: Trend Micro TeamTNT) TeamTNT has also searched for running processes containing the strings aliyun or liyun to identify machines running Alibaba Cloud Security tools.(Citation: Cisco Talos Intelligence Group)
Javali	Javali can monitor processes for open browsers and custom banking applications.(Citation: Securelist Brazilian Banking Malware July 2020)
Trojan.Karagany	Trojan.Karagany can use Tasklist to collect a list of running tasks.(Citation: Symantec Dragonfly)(Citation: Secureworks Karagany July 2019)
APT28	An APT28 loader Trojan will enumerate the victim's processes searching for explorer.exe if its current process does not have necessary permissions.(Citation: Unit 42 Playbook Dec 2017)
ROKRAT	ROKRAT can list the current running processes on the system.(Citation: Talos ROKRAT)(Citation: NCCGroup RokRat Nov 2018)
Pasam	Pasam creates a backdoor through which remote attackers can retrieve lists of running processes.(Citation: Symantec Pasam May 2012)
BabyShark	BabyShark has executed the `tasklist` command.(Citation: Unit42 BabyShark Feb 2019)
GravityRAT	GravityRAT lists the running processes on the system.(Citation: Talos GravityRAT)
Winnti for Windows	Winnti for Windows can check if the explorer.exe process is responsible for calling its install function.(Citation: Novetta Winnti April 2015)
iKitten	iKitten lists the current processes running.(Citation: objsee mac malware 2017)
P8RAT	P8RAT can check for specific processes associated with virtual environments.(Citation: Securelist APT10 March 2021)
down_new	down_new has the ability to list running processes on a compromised host.(Citation: Trend Micro Tick November 2019)
Chimera	Chimera has used `tasklist` to enumerate processes.(Citation: NCC Group Chimera January 2021)
Donut	Donut includes subprojects that enumerate and identify information about Process Injection candidates.(Citation: Donut Github)
BLACKCOFFEE	BLACKCOFFEE has the capability to discover processes.(Citation: FireEye APT17)
	During C0015, the threat actors used the `tasklist /s` command as well as `taskmanager` to obtain a list of running processes.(Citation: DFIR Conti Bazar Nov 2021)
Avaddon	Avaddon has collected information about running processes.(Citation: Arxiv Avaddon Feb 2021)
Helminth	Helminth has used Tasklist to get information on processes.(Citation: Unit 42 Playbook Dec 2017)
yty	yty gets an output of running processes using the `tasklist` command.(Citation: ASERT Donot March 2018)
Gelsemium	Gelsemium can enumerate running processes.(Citation: ESET Gelsemium June 2021)
Kazuar	Kazuar obtains a list of running processes through WMI querying and the `ps` command.(Citation: Unit 42 Kazuar May 2017)
FunnyDream	FunnyDream has the ability to discover processes, including `Bka.exe` and `BkavUtil.exe`.(Citation: Bitdefender FunnyDream Campaign November 2020)
Get2	Get2 has the ability to identify running processes on an infected host.(Citation: Proofpoint TA505 October 2019)
HALFBAKED	HALFBAKED can obtain information about running processes on the victim.(Citation: FireEye FIN7 April 2017)
PowerDuke	PowerDuke has a command to list the victim's processes.(Citation: Volexity PowerDuke November 2016)
Andariel	Andariel has used `tasklist` to enumerate processes and find a specific string.(Citation: Kaspersky Andariel Ransomware June 2021)
BACKSPACE	BACKSPACE may collect information about running processes.(Citation: FireEye APT30)
LookBack	LookBack can list running processes.(Citation: Proofpoint LookBack Malware Aug 2019)
ADVSTORESHELL	ADVSTORESHELL can list running processes.(Citation: ESET Sednit Part 2)
RainyDay	RainyDay can enumerate processes on a target system.(Citation: Bitdefender Naikon April 2021)
ZxShell	ZxShell has a command, ps, to obtain a listing of processes on the system.(Citation: Talos ZxShell Oct 2014)
Lazarus Group	Several Lazarus Group malware families gather a list of running processes on a victim system and send it to their C2 server. A Destover-like variant used by Lazarus Group also gathers process times.(Citation: Novetta Blockbuster)(Citation: Novetta Blockbuster Loaders)(Citation: McAfee Lazarus Resurfaces Feb 2018)(Citation: McAfee GhostSecret)(Citation: TrendMicro macOS Dacls May 2020)(Citation: Lazarus APT January 2022)
Carbanak	Carbanak lists running processes.(Citation: FireEye CARBANAK June 2017)
QakBot	QakBot has the ability to check running processes.(Citation: ATT QakBot April 2021)
FoggyWeb	FoggyWeb's loader can enumerate all Common Language Runtimes (CLRs) and running Application Domains in the compromised AD FS server's `Microsoft.IdentityServer.ServiceHost.exe` process.(Citation: MSTIC FoggyWeb September 2021)
Bazar	Bazar can identity the current process on a compromised host.(Citation: Cybereason Bazar July 2020)
Molerats	Molerats actors obtained a list of active processes on the victim and sent them to C2 servers.(Citation: DustySky)
Nebulae	Nebulae can enumerate processes on a target system.(Citation: Bitdefender Naikon April 2021)
Earth Lusca	Earth Lusca has used Tasklist to obtain information from a compromised host.(Citation: TrendMicro EarthLusca 2022)
MobileOrder	MobileOrder has a command to upload information about all running processes to its C2 server.(Citation: Scarlet Mimic Jan 2016)
NETWIRE	NETWIRE can discover processes on compromised hosts.(Citation: FireEye NETWIRE March 2019)
Bad Rabbit	Bad Rabbit can enumerate all running processes to compare hashes.(Citation: Secure List Bad Rabbit)
4H RAT	4H RAT has the capability to obtain a listing of running processes (including loaded modules).(Citation: CrowdStrike Putter Panda)
KONNI	KONNI has used the command `cmd /c tasklist` to get a snapshot of the current processes on the target machine.(Citation: Medium KONNI Jan 2020)(Citation: Malwarebytes Konni Aug 2021)
FatDuke	FatDuke can list running processes on the localhost.(Citation: ESET Dukes October 2019)
Heyoka Backdoor	Heyoka Backdoor can gather process information.(Citation: SentinelOne Aoqin Dragon June 2022)
KillDisk	KillDisk has called `GetCurrentProcess`.(Citation: Trend Micro KillDisk 2)
ELMER	ELMER is capable of performing process listings.(Citation: FireEye EPS Awakens Part 2)
PowerStallion	PowerStallion has been used to monitor process lists.(Citation: ESET Turla PowerShell May 2019)
Pandora	Pandora can monitor processes on a compromised host.(Citation: Trend Micro Iron Tiger April 2021)
jRAT	jRAT can query and kill system processes.(Citation: Symantec Frutas Feb 2013)
DarkComet	DarkComet can list active processes running on the victim’s machine.(Citation: Malwarebytes DarkComet March 2018)
TajMahal	TajMahal has the ability to identify running processes and associated plugins on an infected host.(Citation: Kaspersky TajMahal April 2019)
Clop	Clop can enumerate all processes on the victim's machine.(Citation: Mcafee Clop Aug 2019)
Volgmer	Volgmer can gather a list of processes.(Citation: Symantec Volgmer Aug 2014)
Gold Dragon	Gold Dragon checks the running processes on the victim’s machine.(Citation: McAfee Gold Dragon)
Crimson	Crimson contains a command to list processes.(Citation: Proofpoint Operation Transparent Tribe March 2016)(Citation: Kaspersky Transparent Tribe August 2020)(Citation: Cisco Talos Transparent Tribe Education Campaign July 2022)
RATANKBA	RATANKBA lists the system’s processes.(Citation: Lazarus RATANKBA)(Citation: RATANKBA)
Mustang Panda	Mustang Panda has used `tasklist /v` to determine active process information.(Citation: Avira Mustang Panda January 2020)
Pillowmint	Pillowmint can iterate through running processes every six seconds collecting a list of processes to capture from later.(Citation: Trustwave Pillowmint June 2020)
Rising Sun	Rising Sun can enumerate all running processes and process information on an infected machine.(Citation: McAfee Sharpshooter December 2018)
Cyclops Blink	Cyclops Blink can enumerate the process it is currently running under.(Citation: NCSC Cyclops Blink February 2022)
Skidmap	Skidmap has monitored critical processes to ensure resiliency.(Citation: Trend Micro Skidmap)
Ramsay	Ramsay can gather a list of running processes by using Tasklist.(Citation: Antiy CERT Ramsay April 2020)
PipeMon	PipeMon can iterate over the running processes to find a suitable injection target.(Citation: ESET PipeMon May 2020)
MacMa	MacMa can enumerate running processes.(Citation: ESET DazzleSpy Jan 2022)
Frankenstein	Frankenstein has enumerated hosts, looking to obtain a list of all currently running processes.(Citation: Talos Frankenstein June 2019)
PLAINTEE	PLAINTEE performs the `tasklist` command to list running processes.(Citation: Rancor Unit42 June 2018)
Linfo	Linfo creates a backdoor through which remote attackers can retrieve a list of running processes.(Citation: Symantec Linfo May 2012)
ShadowPad	ShadowPad has collected the PID of a malicious process.(Citation: Kaspersky ShadowPad Aug 2017)
BISCUIT	BISCUIT has a command to enumerate running processes and identify their owners.(Citation: Mandiant APT1 Appendix)
Mosquito	Mosquito runs `tasklist` to obtain running processes.(Citation: ESET Turla Mosquito Jan 2018)
SUNBURST	SUNBURST collected a list of process names that were hashed using a FNV-1a + XOR algorithm to check against similarly-hashed hardcoded blocklists.(Citation: FireEye SUNBURST Backdoor December 2020)
Komplex	The OsInfo function in Komplex collects a running process list.(Citation: Sofacy Komplex Trojan)
TrickBot	TrickBot uses module networkDll for process list discovery.(Citation: ESET Trickbot Oct 2020)(Citation: Bitdefender Trickbot March 2020)
	During FunnyDream, the threat actors used Tasklist on targeted systems.(Citation: Bitdefender FunnyDream Campaign November 2020)
BLUELIGHT	BLUELIGHT can collect process filenames and SID authority level.(Citation: Volexity InkySquid BLUELIGHT August 2021)
Turla	Turla surveys a system upon check-in to discover running processes using the `tasklist /v` command.(Citation: Kaspersky Turla) Turla RPC backdoors have also enumerated processes associated with specific open ports or named pipes.(Citation: ESET Turla PowerShell May 2019)
MuddyWater	MuddyWater has used malware to obtain a list of running processes on the system.(Citation: Securelist MuddyWater Oct 2018)(Citation: ClearSky MuddyWater June 2019)
OceanSalt	OceanSalt can collect the name and ID for every process running on the system.(Citation: McAfee Oceansalt Oct 2018)
Rocke	Rocke can detect a running process's PID on the infected machine.(Citation: Anomali Rocke March 2019)
Magic Hound	Magic Hound malware can list running processes.(Citation: Unit 42 Magic Hound Feb 2017)
gh0st RAT	gh0st RAT has the capability to list processes.(Citation: FireEye Hacking Team)
HotCroissant	HotCroissant has the ability to list running processes on the infected host.(Citation: Carbon Black HotCroissant April 2020)
CharmPower	CharmPower has the ability to list running processes through the use of `tasklist`.(Citation: Check Point APT35 CharmPower January 2022)
Hydraq	Hydraq creates a backdoor through which remote attackers can monitor processes.(Citation: Symantec Trojan.Hydraq Jan 2010)(Citation: Symantec Hydraq Jan 2010)
HELLOKITTY	HELLOKITTY can search for specific processes to terminate.(Citation: FireEye FiveHands April 2021)
APT37	APT37's Freenki malware lists running processes using the Microsoft Windows API.(Citation: Talos Group123)
PoetRAT	PoetRAT has the ability to list all running processes.(Citation: Talos PoetRAT April 2020)
DRATzarus	DRATzarus can enumerate and examine running processes to determine if a debugger is present.(Citation: ClearSky Lazarus Aug 2020)
Zox	Zox has the ability to list processes.(Citation: Novetta-Axiom)
MarkiRAT	MarkiRAT can search for different processes on a system.(Citation: Kaspersky Ferocious Kitten Jun 2021)
Goopy	Goopy has checked for the Google Updater process to ensure Goopy was loaded properly.(Citation: Cybereason Cobalt Kitty 2017)
Clambling	Clambling can enumerate processes on a targeted system.(Citation: Trend Micro DRBControl February 2020)
SYSCON	SYSCON has the ability to use Tasklist to list running processes.(Citation: Unit 42 CARROTBAT January 2020)
Backdoor.Oldrea	Backdoor.Oldrea collects information about running processes.(Citation: Symantec Dragonfly)
FrameworkPOS	FrameworkPOS can enumerate and exclude selected processes on a compromised host to speed execution of memory scraping.(Citation: SentinelOne FrameworkPOS September 2019)
BBSRAT	BBSRAT can list running processes.(Citation: Palo Alto Networks BBSRAT)
NavRAT	NavRAT uses `tasklist /v` to check running processes.(Citation: Talos NavRAT May 2018)
Kimsuky	Kimsuky can gather a list of all processes running on a victim's machine.(Citation: Talos Kimsuky Nov 2021)
XAgentOSX	XAgentOSX contains the getProcessList function to run `ps aux` to get running processes.(Citation: XAgentOSX 2017)
Saint Bot	Saint Bot has enumerated running processes on a compromised host to determine if it is running under the process name `dfrgui.exe`.(Citation: Palo Alto Unit 42 OutSteel SaintBot February 2022 )
Dtrack	Dtrack’s dropper can list all running processes.(Citation: Securelist Dtrack)(Citation: CyberBit Dtrack)
USBferry	USBferry can use `tasklist` to gather information about the process running on the infected system.(Citation: TrendMicro Tropic Trooper May 2020)
Kwampirs	Kwampirs collects a list of running services with the command `tasklist /v`.(Citation: Symantec Orangeworm April 2018)
Bumblebee	Bumblebee can identify processes associated with analytical tools.(Citation: Proofpoint Bumblebee April 2022)(Citation: Symantec Bumblebee June 2022)(Citation: Medium Ali Salem Bumblebee April 2022)
PowerSploit	PowerSploit's `Get-ProcessTokenPrivilege` Privesc-PowerUp module can enumerate privileges for a given process.(Citation: GitHub PowerSploit May 2012)(Citation: PowerSploit Documentation)
Cuba	Cuba can enumerate processes running on a victim's machine.(Citation: McAfee Cuba April 2021)
RogueRobin	RogueRobin checks the running processes for evidence it may be running in a sandbox environment. It specifically enumerates processes for Wireshark and Sysinternals.(Citation: Unit 42 DarkHydrus July 2018)
Proxysvc	Proxysvc lists processes running on the system.(Citation: McAfee GhostSecret)
Maze	Maze has gathered all of the running system processes.(Citation: McAfee Maze March 2020)
ObliqueRAT	ObliqueRAT can check for blocklisted process names on a compromised host.(Citation: Talos Oblique RAT March 2021)
Higaisa	Higaisa’s shellcode attempted to find the process ID of the current process.(Citation: Zscaler Higaisa 2020)
Poseidon Group	After compromising a victim, Poseidon Group lists all running processes.(Citation: Kaspersky Poseidon Group)
Ke3chang	Ke3chang performs process discovery using `tasklist` commands.(Citation: Mandiant Operation Ke3chang November 2014)(Citation: NCC Group APT15 Alive and Strong)
ThiefQuest	ThiefQuest obtains a list of running processes using the function `kill_unwanted`.(Citation: wardle evilquest parti)
SHOTPUT	SHOTPUT has a command to obtain a process listing.(Citation: Palo Alto CVE-2015-3113 July 2015)
SodaMaster	SodaMaster can search a list of running processes.(Citation: Securelist APT10 March 2021)
Honeybee	Honeybee gathers a list of processes using the `tasklist` command and then is sent back to the control server.(Citation: McAfee Honeybee)
HEXANE	HEXANE has enumerated processes on targeted systems.(Citation: Kaspersky Lyceum October 2021)
SLOTHFULMEDIA	SLOTHFULMEDIA has enumerated processes by ID, name, or privileges.(Citation: CISA MAR SLOTHFULMEDIA October 2020)
Babuk	Babuk has the ability to check running processes on a targeted system.(Citation: Sogeti CERT ESEC Babuk March 2021)(Citation: McAfee Babuk February 2021)(Citation: Trend Micro Ransomware February 2021)
Inception	Inception has used a reconnaissance module to identify active processes and other associated loaded modules.(Citation: Symantec Inception Framework March 2018)
Taidoor	Taidoor can use `GetCurrentProcessId` for process discovery.(Citation: CISA MAR-10292089-1.v2 TAIDOOR August 2021)
SDBbot	SDBbot can enumerate a list of running processes on a compromised machine.(Citation: Korean FSI TA505 2020)
POORAIM	POORAIM can enumerate processes.(Citation: FireEye APT37 Feb 2018)
njRAT	njRAT can search a list of running processes for Tr.exe.(Citation: Trend Micro njRAT 2018)
FinFisher	FinFisher checks its parent process for indications that it is running in a sandbox setup.(Citation: FinFisher Citation)(Citation: Microsoft FinFisher March 2018)
OilRig	OilRig has run `tasklist` on a victim's machine.(Citation: Palo Alto OilRig May 2016)
Waterbear	Waterbear can identify the process for a specific security product.(Citation: Trend Micro Waterbear December 2019)
SynAck	SynAck enumerates all running processes.(Citation: SecureList SynAck Doppelgänging May 2018)(Citation: Kaspersky Lab SynAck May 2018)
APT3	APT3 has a tool that can list out currently running processes.(Citation: FireEye Clandestine Fox)(Citation: evolution of pirpi)
PLEAD	PLEAD has the ability to list processes on the compromised host.(Citation: TrendMicro BlackTech June 2017)
StrongPity	StrongPity can determine if a user is logged in by checking to see if explorer.exe is running.(Citation: Talos Promethium June 2020)
Kinsing	Kinsing has used ps to list processes.(Citation: Aqua Kinsing April 2020)
Gamaredon Group	Gamaredon Group has used tools to enumerate processes on target hosts including Process Explorer.(Citation: Symantec Shuckworm January 2022)(Citation: Unit 42 Gamaredon February 2022)
SILENTTRINITY	SILENTTRINITY can enumerate processes, including properties to determine if they have the Common Language Runtime (CLR) loaded.(Citation: GitHub SILENTTRINITY Modules July 2019)
	During Operation Honeybee, the threat actors obtained a list of running processes on a victim machine using `cmd /c tasklist > %temp%\temp.ini`.(Citation: McAfee Honeybee)
EvilBunny	EvilBunny has used EnumProcesses() to identify how many process are running in the environment.(Citation: Cyphort EvilBunny Dec 2014)
UBoatRAT	UBoatRAT can list running processes on the system.(Citation: PaloAlto UBoatRAT Nov 2017)
Emotet	Emotet has been observed enumerating local processes.(Citation: ASEC Emotet 2017)
	During Operation CuckooBees, the threat actors used the `tasklist` command as part of their advanced reconnaissance.(Citation: Cybereason OperationCuckooBees May 2022)
Carbon	Carbon can list the processes on the victim’s machine.(Citation: ESET Carbon Mar 2017)
ChChes	ChChes collects its process identifier (PID) on the victim.(Citation: Palo Alto menuPass Feb 2017)
OutSteel	OutSteel can identify running processes on a compromised host.(Citation: Palo Alto Unit 42 OutSteel SaintBot February 2022 )
Winnti Group	Winnti Group looked for a specific process running on infected servers.(Citation: Kaspersky Winnti April 2013)
Lizar	Lizar has a plugin designed to obtain a list of processes.(Citation: Threatpost Lizar May 2021)(Citation: BiZone Lizar May 2021)
Metamorfo	Metamorfo has performed process name checks and has monitored applications.(Citation: Medium Metamorfo Apr 2020)
Conti	Conti can enumerate through all open processes to search for any that have the string “sql” in their process name.(Citation: CarbonBlack Conti July 2020)
InvisiMole	InvisiMole can obtain a list of running processes.(Citation: ESET InvisiMole June 2018)(Citation: ESET InvisiMole June 2020)
Socksbot	Socksbot can list all running processes.(Citation: TrendMicro Patchwork Dec 2017)
Cobalt Strike	Cobalt Strike's Beacon payload can collect information on process details.(Citation: cobaltstrike manual)(Citation: Talos Cobalt Strike September 2020)(Citation: Cobalt Strike Manual 4.3 November 2020)
Cardinal RAT	Cardinal RAT contains watchdog functionality that ensures its process is always running, else spawns a new instance.(Citation: PaloAlto CardinalRat Apr 2017)
Empire	Empire can find information about processes running on local and remote systems.(Citation: Github PowerShell Empire)(Citation: Talos Frankenstein June 2019)
CaddyWiper	CaddyWiper can obtain a list of current processes.(Citation: Malwarebytes IssacWiper CaddyWiper March 2022 )
Derusbi	Derusbi collects current and parent process IDs.(Citation: Fidelis Turbo)(Citation: FireEye Periscope March 2018)
Meteor	Meteor can check if a specific process is running, such as Kaspersky's `avp.exe`.(Citation: Check Point Meteor Aug 2021)
RTM	RTM can obtain information about process integrity levels.(Citation: ESET RTM Feb 2017)
Flagpro	Flagpro has been used to run the `tasklist` command on a compromised system.(Citation: NTT Security Flagpro new December 2021)
macOS.OSAMiner	macOS.OSAMiner has used `ps ax \| grep \| grep -v grep \| ...` and `ps ax \| grep -E...` to conduct process discovery.(Citation: SentinelLabs reversing run-only applescripts 2021)
DustySky	DustySky collects information about running processes from victims.(Citation: DustySky)(Citation: Kaspersky MoleRATs April 2019)
APT38	APT38 leveraged Sysmon to understand the processes, services in the organization.(Citation: FireEye APT38 Oct 2018)
Azorult	Azorult can collect a list of running processes by calling CreateToolhelp32Snapshot.(Citation: Unit42 Azorult Nov 2018)(Citation: Proofpoint Azorult July 2018)
Bonadan	Bonadan can use the `ps` command to discover other cryptocurrency miners active on the system.(Citation: ESET ForSSHe December 2018)
VERMIN	VERMIN can get a list of the processes and running tasks on the system.(Citation: Unit 42 VERMIN Jan 2018)
ShimRatReporter	ShimRatReporter listed all running processes on the machine.(Citation: FOX-IT May 2016 Mofang)
UNC2452	UNC2452 used multiple command-line utilities to enumerate running processes.(Citation: Volexity SolarWinds)(Citation: Microsoft Deep Dive Solorigate January 2021)
Carberp	Carberp has collected a list of running processes.(Citation: Trusteer Carberp October 2010)
Pupy	Pupy can list the running processes and get the process ID and parent process’s ID.(Citation: GitHub Pupy)
Doki	Doki has searched for the current process’s PID.(Citation: Intezer Doki July 20)
	During Operation Wocao, the threat actors used `tasklist` to collect a list of running processes on an infected system.(Citation: FoxIT Wocao December 2019)
POWERSTATS	POWERSTATS has used `get_tasklist` to discover processes on the compromised host.(Citation: TrendMicro POWERSTATS V3 June 2019)

Контрмера	Описание
Контрмеры
Process Discovery Mitigation	Identify unnecessary system utilities or potentially malicious software that may be used to acquire information about processes, and audit and/or block them by using whitelisting (Citation: Beechey 2010) tools, like AppLocker, (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) or Software Restriction Policies (Citation: Corio 2008) where appropriate. (Citation: TechNet Applocker vs SRP)

Обнаружение

System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as Lateral Movement, based on the information obtained. Normal, benign system and network events that look like process discovery may be uncommon, depending on the environment and how they are used. Monitor processes and command-line arguments for actions that could be taken to gather system and network information. Remote access tools with built-in features may interact directly with the Windows API to gather information. Information may also be acquired through Windows system management tools such as Windows Management Instrumentation and PowerShell.

Ссылки

Связанные риски

Ничего не найдено

Каталоги

Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.

Исследование процессов

Примеры процедур

Контрмеры

Обнаружение

Ссылки

Связанные риски

Каталоги