MITRE ATT&CKtechnique

T1057 Process Discovery

Published 2017-05-31 Modified 2026-09-11 Official page ↗
Domain
enterprise
Tactics
Discovery
Platforms
ESXi, Linux, macOS, Network Devices, Windows
Version
1.6
Created
2017-05-31

Description

Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Administrator or otherwise elevated access may provide better process details. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. In Windows environments, adversaries could obtain details on running processes using the Tasklist utility via cmd or Get-Process via PowerShell. Information about processes can also be extracted from the output of Native API calls such as CreateToolhelp32Snapshot. In Mac and Linux, this is accomplished with the ps command. Adversaries may also opt to enumerate processes via `/proc`. ESXi also supports use of the `ps` command, as well as `esxcli system process list`. On network devices, Network Device CLI commands such as `show processes` can be used to display current running processes.

Related

Tactic · MITRE ATT&CK (1)

Referenced by MITRE ATT&CK · uses (326)

  • G1059 NIMBUS MANTICORE group
  • S9060 MiniBus software (malware)
  • S9052 MiniFast software (malware)
  • S9053 MiniJunk software (malware)
  • S9050 Vidar software (malware)
  • C0064 AI-Assisted Breach of Mexico's Government Infrastructure campaign
  • S9045 BACKUPOSINT v9.0 APEX PREDATOR software (malware)
  • S9041 TeamPCP Cloud Stealer software (malware)
  • C0063 2025 Poland Wiper Attacks campaign
  • S9035 LAMEHUG software (malware)
  • S9036 LP-Notes software (malware)
  • S9031 AshTag software (malware)
  • S9032 MuddyViper software (malware)
  • G1054 MirrorFace group
  • S9020 LODEINFO software (malware)
  • S9023 HiddenFace software (malware)
  • S9024 SPAWNCHIMERA software (malware)
  • S9015 BRICKSTORM software (malware)
  • S9019 PureCrypter software (malware)
  • S9012 TRAILBLAZE software (malware)
  • S9001 SystemBC software (malware)
  • G1053 Storm-0501 group
  • S1247 Embargo software (malware)
  • S1244 Medusa Ransomware software (malware)
  • S1245 InvisibleFerret software (malware)
  • G1051 Medusa Group group
  • S1242 Qilin software (malware)
  • S1239 TONESHELL software (malware)
  • S1233 PAKLOG software (malware)
  • S1230 HIUPAN software (malware)
Show all 326 ›

Referenced by CAPEC · att&ck technique (1)

  • CAPEC-573 Process Footprinting attack pattern

References