Technique:  Process Discovery
4H RAT has the capability to obtain a listing of running processes (including loaded modules).
ADVSTORESHELL can list running processes.
Agent Tesla can list the current running processes on the system.
It has used tasklist to enumerate processes and find a specific string.
AppleSeed can enumerate the current process on a compromised host.
It gathered a list of running processes on the system using tasklist /v.
An It loader Trojan will enumerate the victim's processes searching for explorer.exe if its current process does not have necessary permissions.
It has a tool that can list out currently running processes.
It's Freenki malware lists running processes using the Microsoft Windows API.
It leveraged Sysmon to understand the processes, services in the organization.
Aria-body has the ability to enumerate loaded modules for a process..
Astaroth searches for different processes on the system.
AsyncRAT can examine running processes to determine if a debugger is present.
Avaddon has collected information about running processes.
Avenger has the ability to use Tasklist to identify running processes.
AvosLocker has discovered system processes by calling RmGetList.
Azorult can collect a list of running processes by calling CreateToolhelp32Snapshot.
Babuk has the ability to check running processes on a targeted system.
BabyShark has executed the tasklist command.
Backdoor.Oldrea collects information about running processes.
BACKSPACE may collect information about running processes.
Bad Rabbit can enumerate all running processes to compare hashes.
BADHATCH can retrieve a list of running processes from a compromised machine.
Bankshot identifies processes and collects the process ids.
Bazar can identity the current process on a compromised host.
BBSRAT can list running processes.
BISCUIT has a command to enumerate running processes and identify their owners.
Bisonal can obtain a list of running processes on the victim’s machine.
BLACKCOFFEE has the capability to discover processes.
BlackEnergy has gathered a process list by using Tasklist.exe.
BLUELIGHT can collect process filenames and SID authority level.
Bonadan can use the ps command to discover other cryptocurrency miners active on the system.
Brave Prince lists the running processes.
Brute Ratel C4 can enumerate all processes and locate specific process IDs (PIDs).
Bumblebee can identify processes associated with analytical tools.
Bundlore has used the ps command to list processes.
During C0015, the threat actors used the tasklist /s command as well as taskmanager to obtain a list of running processes.
CaddyWiper can obtain a list of current processes.
Cannon can obtain a list of processes running on the system.
It lists running processes.
Carberp has collected a list of running processes.
Carbon can list the processes on the victim’s machine.
Cardinal RAT contains watchdog functionality that ensures its process is always running, else spawns a new instance.
Caterpillar WebShell can gather a list of processes running on the machine.
CharmPower has the ability to list running processes through the use of tasklist.
ChChes collects its process identifier (PID) on the victim.
It has used tasklist to enumerate processes.
Clambling can enumerate processes on a targeted system.
Clop can enumerate all processes on the victim's machine.
Cobalt Strike's Beacon payload can collect information on process details.
Comnie uses the tasklist to view running processes on the victim’s machine.
Conti can enumerate through all open processes to search for any that have the string "sql" in their process name.
Crimson contains a command to list processes.
Cuba can enumerate processes running on a victim's machine.
Cyclops Blink can enumerate the process it is currently running under.
Dacls can collect data on running and parent processes.
DarkComet can list active processes running on the victim’s machine.
It malware can collect a list of running processes on a system.
DarkTortilla can enumerate a list of running processes on a compromised system.
It uses the Microsoft Tasklist utility to list processes running on systems.
Derusbi collects current and parent process IDs.
Diavol has used CreateToolhelp32Snapshot, Process32First, and Process32Next API calls to enumerate the running processes in the system.
Doki has searched for the current process’s PID.
Donut includes subprojects that enumerate and identify information about Process Injection candidates.
down_new has the ability to list running processes on a compromised host.
DRATzarus can enumerate and examine running processes to determine if a debugger is present.
Dtrack’s dropper can list all running processes.
The discovery modules used with Duqu can collect information on process details.
DustySky collects information about running processes from victims.
It has used Tasklist to obtain information from a compromised host.
EKANS looks for processes from a hard-coded list.
Elise enumerates processes via the tasklist command.
ELMER is capable of performing process listings.
Emotet has been observed enumerating local processes.
Empire can find information about processes running on local and remote systems.
Epic uses the tasklist /v command to obtain a list of processes.
EvilBunny has used EnumProcesses() to identify how many process are running in the environment.
FatDuke can list running processes on the localhost.
FELIXROOT collects a list of running processes.
Final1stspy obtains a list of running processes.
FinFisher checks its parent process for indications that it is running in a sandbox setup.
Flagpro has been used to run the tasklist command on a compromised system.
FoggyWeb's loader can enumerate all Common Language Runtimes (CLRs) and running Application Domains in the compromised AD FS server's Microsoft.IdentityServer.ServiceHost.exe process.
FrameworkPOS can enumerate and exclude selected processes on a compromised host to speed execution of memory scraping.
During Frankenstein, the threat actors used Empire to obtain a list of all running processes.
FruitFly has the ability to list processes on the system.
FunnyDream has the ability to discover processes, including Bka.exe and BkavUtil.exe.
During FunnyDream, the threat actors used Tasklist on targeted systems.
Fysbis can collect information about running processes.
It has used tools to enumerate processes on target hosts including Process Explorer.
Gelsemium can enumerate running processes.
GeminiDuke collects information on running processes and environment variables from the victim.
Get2 has the ability to identify running processes on an infected host.
gh0st RAT has the capability to list processes.
Gold Dragon checks the running processes on the victim’s machine.
Goopy has checked for the Google Updater process to ensure Goopy was loaded properly.
Grandoreiro can identify installed security tools based on process names.
GravityRAT lists the running processes on the system.
It has used tasklist to enumerate processes.
HALFBAKED can obtain information about running processes on the victim.
HELLOKITTY can search for specific processes to terminate.
Helminth has used Tasklist to get information on processes.
It has enumerated processes on targeted systems.
Heyoka Backdoor can gather process information.
It’s shellcode attempted to find the process ID of the current process.
HotCroissant has the ability to list running processes on the infected host.
Hydraq creates a backdoor through which remote attackers can monitor processes.
iKitten lists the current processes running.
Imminent Monitor has a "Process Watcher" feature to monitor processes in case the client ever crashes or gets closed.
It has used a reconnaissance module to identify active processes and other associated loaded modules.
Industroyer2 has the ability to cyclically enumerate running processes such as PServiceControl.exe, PService_PDD.exe, and other targets supplied through a hardcoded configuration.
InvisiMole can obtain a list of running processes.
IronNetInjector can identify processes via C# methods such as GetProcessesByName and running Tasklist with the Python os.popen function.
Ixeshe can list running processes.
Javali can monitor processes for open browsers and custom banking applications.
JHUHUGIT obtains a list of running processes on the victim.
JPIN can list running processes.
jRAT can query and kill system processes.
Kasidet has the ability to search for a given process name in processes currently running in the system.
Kazuar obtains a list of running processes through WMI querying and the ps command.
It performs process discovery using tasklist commands.
KEYMARBLE can obtain a list of running processes on the system.
KillDisk has called GetCurrentProcess.
It can gather a list of all processes running on a victim's machine.
Kinsing has used ps to list processes.
The OsInfo function in Komplex collects a running process list.
KONNI has used the command cmd /c tasklist to get a snapshot of the current processes on the target machine.
KOPILUWAK can enumerate current running processes on the targeted machine.
Kwampirs collects a list of running services with the command tasklist /v.
Several It malware families gather a list of running processes on a victim system and send it to their C2 server. A Destover-like variant used by It also gathers process times.
Linfo creates a backdoor through which remote attackers can retrieve a list of running processes.
Lizar has a plugin designed to obtain a list of processes.
LookBack can list running processes.
LoudMiner used the ps command to monitor the running processes on the system.
Lucifer can identify the process that owns remote connections.
It has a component to check for running processes to look for web browsers.
MacMa can enumerate running processes.
macOS.OSAMiner has used ps ax | grep <name> | grep -v grep | ... and ps ax | grep -E... to conduct process discovery.
Mafalda can enumerate running processes on a machine.
It malware can list running processes.
MarkiRAT can search for different processes on a system.
Maze has gathered all of the running system processes.
metaMain can enumerate the processes that run on the platform.
Metamorfo has performed process name checks and has monitored applications.
Meteor can check if a specific process is running, such as Kaspersky's avp.exe.
MobileOrder has a command to upload information about all running processes to its C2 server.
It actors obtained a list of active processes on the victim and sent them to C2 servers.
MoonWind has a command to return a list of running processes.
Mosquito runs tasklist to obtain running processes.
It has used malware to obtain a list of running processes on the system.
It has used tasklist /v to determine active process information.
NavRAT uses tasklist /v to check running processes.
Nebulae can enumerate processes on a target system.
NETEAGLE can send process listings over the C2 channel.
NETWIRE can discover processes on compromised hosts.
NightClub has the ability to use GetWindowThreadProcessId to identify the process behind a specified window.
njRAT can search a list of running processes for Tr.exe.
ObliqueRAT can check for blocklisted process names on a compromised host.
OceanSalt can collect the name and ID for every process running on the system.
It has run tasklist on a victim's machine.
During Operation CuckooBees, the threat actors used the tasklist command as part of their advanced reconnaissance.
During Operation Honeybee, the threat actors obtained a list of running processes on a victim machine using cmd /c tasklist > %temp%\temp.ini.
During Operation Wocao, the threat actors used tasklist to collect a list of running processes on an infected system.
Orz can gather a process list from the victim.
OutSteel can identify running processes on a compromised host.
P8RAT can check for specific processes associated with virtual environments.
Pandora can monitor processes on a compromised host.
Pasam creates a backdoor through which remote attackers can retrieve lists of running processes.
PcShare can obtain a list of running processes on a compromised host.
Pillowmint can iterate through running processes every six seconds collecting a list of processes to capture from later.
PipeMon can iterate over the running processes to find a suitable injection target.
PLAINTEE performs the tasklist command to list running processes.
PLEAD has the ability to list processes on the compromised host.
PlugX has a module to list the processes running on a machine.
PoetRAT has the ability to list all running processes.
POORAIM can enumerate processes.
After compromising a victim, It lists all running processes.
PowerDuke has a command to list the victim's processes.
PowerShower has the ability to deploy a reconnaissance module to retrieve a list of the active processes.
PowerSploit's Get-ProcessTokenPrivilege Privesc-PowerUp module can enumerate privileges for a given process.
PowerStallion has been used to monitor process lists.
POWERSTATS has used get_tasklist to discover processes on the compromised host.
POWRUNER may collect process information by running tasklist on a victim.
Proxysvc lists processes running on the system.
Pupy can list the running processes and get the process ID and parent process’s ID.
QakBot has the ability to check running processes.
RainyDay can enumerate processes on a target system.
Ramsay can gather a list of running processes by using Tasklist.
RATANKBA lists the system’s processes.
RCSession can identify processes based on PID.
Remsec can obtain a process list from the victim.
Rising Sun can enumerate all running processes and process information on an infected machine.
It can detect a running process's PID on the infected machine.
RogueRobin checks the running processes for evidence it may be running in a sandbox environment. It specifically enumerates processes for Wireshark and Sysinternals.
ROKRAT can list the current running processes on the system.
RotaJakiro can monitor the /proc/[PID] directory of known RotaJakiro processes as a part of its persistence when executing with non-root permissions. If the process is found dead, it resurrects the process. RotaJakiro processes can be matched to an associated Advisory Lock, in the /proc/locks folder, to ensure it doesn't spawn more than one process.
Royal can use GetCurrentProcess to enumerate processes.
It can obtain information about process integrity levels.
Ryuk has called CreateToolhelp32Snapshot to enumerate all running processes.
Saint Bot has enumerated running processes on a compromised host to determine if it is running under the process name dfrgui.exe.
Sardonic has the ability to execute the tasklist command.
SDBbot can enumerate a list of running processes on a compromised machine.
Seasalt has a command to perform a process listing.
ShadowPad has collected the PID of a malicious process.
ShimRatReporter listed all running processes on the machine.
SHOTPUT has a command to obtain a process listing.
It has used tools to identify running processes on the victim's machine.
SILENTTRINITY can enumerate processes, including properties to determine if they have the Common Language Runtime (CLR) loaded.
Skidmap has monitored critical processes to ensure resiliency.
SLOTHFULMEDIA has enumerated processes by ID, name, or privileges.
Socksbot can list all running processes.
SodaMaster can search a list of running processes.
During the SolarWinds Compromise, It used multiple command-line utilities to enumerate running processes.
SombRAT can use the getprocesslist command to enumerate processes on a compromised host.
SoreFang can enumerate processes on a victim machine through use of Tasklist.
It malware gathers a list of running processes.
StreamEx has the ability to enumerate processes.
StrongPity can determine if a user is logged in by checking to see if explorer.exe is running.
SUNBURST collected a list of process names that were hashed using a FNV-1a + XOR algorithm to check against similarly-hashed hardcoded blocklists.
SUNSPOT monitored running processes for instances of MsBuild.exe by hashing the name of each running process and comparing it to the corresponding value 0x53D525. It also extracted command-line arguments and individual arguments from the running MsBuild.exe process to identify the directory path of the Orion software Visual Studio solution.
SVCReady can collect a list of running processes from an infected host.
Sykipot may gather a list of running processes by running tasklist /v.
SynAck enumerates all running processes.
SYSCON has the ability to use Tasklist to list running processes.
SysUpdate can collect information about running processes.
Taidoor can use GetCurrentProcessId for process discovery.
TAINTEDSCRIBE can execute ProcessList for process discovery.
TajMahal has the ability to identify running processes and associated plugins on an infected host.
Tasklist can be used to discover processes running on a system.
It has searched for rival malware and removes it if found. It has also searched for running processes containing the strings aliyun or liyun to identify machines running Alibaba Cloud Security tools.
ThiefQuest obtains a list of running processes using the function kill_unwanted.
TrickBot uses module networkDll for process list discovery.
Trojan.Karagany can use Tasklist to collect a list of running tasks.
It is capable of enumerating the running processes on the system using pslist.
TSCookie has the ability to list processes on the infected host.
It surveys a system upon check-in to discover running processes using the tasklist /v command. It RPC backdoors have also enumerated processes associated with specific open ports or named pipes.
UBoatRAT can list running processes on the system.
Uroburos can use its Process List command to enumerate processes on compromised hosts.
Ursnif has gathered information about running processes.
USBferry can use tasklist to gather information about the process running on the infected system.
Valak has the ability to enumerate running processes on a compromised host.
VERMIN can get a list of the processes and running tasks on the system.
Volgmer can gather a list of processes.
It has enumerated running processes on targeted systems.
WarzoneRAT can obtain a list of processes on a compromised host.
Waterbear can identify the process for a specific security product.
It has used malware to enumerate active processes.
WINERACK can enumerate processes.
WinMM sets a WH_CBT Windows hook to collect information on process creation.
Winnti for Windows can check if the explorer.exe process is responsible for calling its install function.
It looked for a specific process running on infected servers.
Woody RAT can call NtQuerySystemProcessInformation with SystemProcessInformation to enumerate all running processes, including associated information such as PID, parent PID, image name, and owner.
XAgentOSX contains the getProcessList function to run ps aux to get running processes.
yty gets an output of running processes using the tasklist command.
Zebrocy uses the tasklist and wmic process get Capture, ExecutablePath commands to gather the processes running on the system.
Zeus Panda checks for running processes on the victim’s machine.
Zox has the ability to list processes.
ZxShell has a command, ps, to obtain a listing of processes on the system.
ZxxZ has created a snapshot of running processes using CreateToolhelp32Snapshot.