Description
Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Administrator or otherwise elevated access may provide better process details. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
In Windows environments, adversaries could obtain details on running processes using the Tasklist utility via cmd or Get-Process via PowerShell. Information about processes can also be extracted from the output of Native API calls such as CreateToolhelp32Snapshot. In Mac and Linux, this is accomplished with the ps command. Adversaries may also opt to enumerate processes via /proc. ESXi also supports use of the ps command, as well as esxcli system process list.(Citation: Sygnia ESXi Ransomware 2025)(Citation: Crowdstrike Hypervisor Jackpotting Pt 2 2021)
On network devices, Network Device CLI commands such as show processes can be used to display current running processes.(Citation: US-CERT-TA18-106A)(Citation: show_processes_cisco_cmd)
Platforms
Threat Groups (41)
| ID | Group | Context |
|---|---|---|
| G0082 | APT38 | [APT38](https://attack.mitre.org/groups/G0082) leveraged Sysmon to understand the processes, services in the organization.(Citation: FireEye APT38 Oct... |
| G0022 | APT3 | [APT3](https://attack.mitre.org/groups/G0022) has a tool that can list out currently running processes.(Citation: FireEye Clandestine Fox)(Citation: e... |
| G0094 | Kimsuky | [Kimsuky](https://attack.mitre.org/groups/G0094) can gather a list of all processes running on a victim's machine.(Citation: Talos Kimsuky Nov 2021) [... |
| G1017 | Volt Typhoon | [Volt Typhoon](https://attack.mitre.org/groups/G1017) has enumerated running processes on targeted systems including through the use of [Tasklist](htt... |
| G0125 | HAFNIUM | [HAFNIUM](https://attack.mitre.org/groups/G0125) has used `tasklist` to enumerate processes.(Citation: Rapid7 HAFNIUM Mar 2021) |
| G0069 | MuddyWater | [MuddyWater](https://attack.mitre.org/groups/G0069) has used malware to obtain a list of running processes on the system.(Citation: Securelist MuddyWa... |
| G0047 | Gamaredon Group | [Gamaredon Group](https://attack.mitre.org/groups/G0047) has used tools to enumerate processes on target hosts including Process Explorer.(Citation: S... |
| G0139 | TeamTNT | [TeamTNT](https://attack.mitre.org/groups/G0139) has searched for rival malware and removes it if found.(Citation: Trend Micro TeamTNT) [TeamTNT](http... |
| G0046 | FIN7 | [FIN7](https://attack.mitre.org/groups/G0046) has used the PowerShell script 3CF9.ps1 to perform process discovery by executing `tasklist /v`. Additio... |
| G0138 | Andariel | [Andariel](https://attack.mitre.org/groups/G0138) has used <code>tasklist</code> to enumerate processes and find a specific string.(Citation: Kaspersk... |
| G0121 | Sidewinder | [Sidewinder](https://attack.mitre.org/groups/G0121) has used tools to identify running processes on the victim's machine.(Citation: ATT Sidewinder Jan... |
| G0129 | Mustang Panda | [Mustang Panda](https://attack.mitre.org/groups/G0129) has used <code>tasklist /v</code> to determine active process information.(Citation: Avira Must... |
| G0106 | Rocke | [Rocke](https://attack.mitre.org/groups/G0106) can detect a running process's PID on the infected machine.(Citation: Anomali Rocke March 2019) |
| G1048 | UNC3886 | [UNC3886](https://attack.mitre.org/groups/G1048) has run scripts to list all running processes on a guest VM from an ESXi host.(Citation: Google Cloud... |
| G0067 | APT37 | [APT37](https://attack.mitre.org/groups/G0067)'s Freenki malware lists running processes using the Microsoft Windows API.(Citation: Talos Group123) |
| G0049 | OilRig | [OilRig](https://attack.mitre.org/groups/G0049) has run <code>tasklist</code> on a victim's machine and used infostealers to capture processes.(Citati... |
| G0126 | Higaisa | [Higaisa](https://attack.mitre.org/groups/G0126)’s shellcode attempted to find the process ID of the current process.(Citation: Zscaler Higaisa 2020) |
| G0081 | Tropic Trooper | [Tropic Trooper](https://attack.mitre.org/groups/G0081) is capable of enumerating the running processes on the system using <code>pslist</code>.(Citat... |
| G0004 | Ke3chang | [Ke3chang](https://attack.mitre.org/groups/G0004) performs process discovery using <code>tasklist</code> commands.(Citation: Mandiant Operation Ke3cha... |
| G0006 | APT1 | [APT1](https://attack.mitre.org/groups/G0006) gathered a list of running processes on the system using <code>tasklist /v</code>.(Citation: Mandiant AP... |
Associated Software (268)
| ID | Name | Type | Context |
|---|---|---|---|
| S0266 | TrickBot | Malware | [TrickBot](https://attack.mitre.org/software/S0266) uses module networkDll for process list discovery.(Citation: ESET Trickbot Oct 2020)(Citation: Bit... |
| S0139 | PowerDuke | Malware | [PowerDuke](https://attack.mitre.org/software/S0139) has a command to list the victim's processes.(Citation: Volexity PowerDuke November 2016) |
| S0605 | EKANS | Malware | [EKANS](https://attack.mitre.org/software/S0605) looks for processes from a hard-coded list.(Citation: Dragos EKANS)(Citation: FireEye Ransomware Feb ... |
| S1100 | Ninja | Malware | [Ninja](https://attack.mitre.org/software/S1100) can enumerate processes on a targeted host.(Citation: Kaspersky ToddyCat June 2022)(Citation: Kaspers... |
| S0662 | RCSession | Malware | [RCSession](https://attack.mitre.org/software/S0662) can identify processes based on PID.(Citation: Profero APT27 December 2020) |
| S0242 | SynAck | Malware | [SynAck](https://attack.mitre.org/software/S0242) enumerates all running processes.(Citation: SecureList SynAck Doppelgänging May 2018)(Citation: Kasp... |
| S1039 | Bumblebee | Malware | [Bumblebee](https://attack.mitre.org/software/S1039) can identify processes associated with analytical tools.(Citation: Proofpoint Bumblebee April 202... |
| S9015 | BRICKSTORM | Malware | [BRICKSTORM](https://attack.mitre.org/software/S9015) has the ability to check if it is running as an active child process through the detection of a ... |
| S0238 | Proxysvc | Malware | [Proxysvc](https://attack.mitre.org/software/S0238) lists processes running on the system.(Citation: McAfee GhostSecret) |
| S0229 | Orz | Malware | [Orz](https://attack.mitre.org/software/S0229) can gather a process list from the victim.(Citation: Proofpoint Leviathan Oct 2017) |
| S0248 | yty | Malware | [yty](https://attack.mitre.org/software/S0248) gets an output of running processes using the <code>tasklist</code> command.(Citation: ASERT Donot Marc... |
| S0093 | Backdoor.Oldrea | Malware | [Backdoor.Oldrea](https://attack.mitre.org/software/S0093) collects information about running processes.(Citation: Symantec Dragonfly) |
| S1078 | RotaJakiro | Malware | [RotaJakiro](https://attack.mitre.org/software/S1078) can monitor the `/proc/[PID]` directory of known [RotaJakiro](https://attack.mitre.org/software/... |
| S1053 | AvosLocker | Malware | [AvosLocker](https://attack.mitre.org/software/S1053) has discovered system processes by calling `RmGetList`.(Citation: Malwarebytes AvosLocker Jul 20... |
| S0460 | Get2 | Malware | [Get2](https://attack.mitre.org/software/S0460) has the ability to identify running processes on an infected host.(Citation: Proofpoint TA505 October ... |
| S0184 | POWRUNER | Malware | [POWRUNER](https://attack.mitre.org/software/S0184) may collect process information by running <code>tasklist</code> on a victim.(Citation: FireEye AP... |
| S1075 | KOPILUWAK | Malware | [KOPILUWAK](https://attack.mitre.org/software/S1075) can enumerate current running processes on the targeted machine.(Citation: Mandiant Suspected Tur... |
| S1233 | PAKLOG | Malware | [PAKLOG](https://attack.mitre.org/software/S1233) has detected and logged the full path of processes active in the foreground using Windows API calls.... |
| S1105 | COATHANGER | Malware | [COATHANGER](https://attack.mitre.org/software/S1105) will query running process information to determine subsequent program execution flow.(Citation:... |
| S1085 | Sardonic | Malware | [Sardonic](https://attack.mitre.org/software/S1085) has the ability to execute the `tasklist` command.(Citation: Bitdefender Sardonic Aug 2021) |
References
- Cisco. (2022, August 16). show processes - . Retrieved July 13, 2022.
- Michael Dawson. (2021, August 30). Hypervisor Jackpotting, Part 2: eCrime Actors Increase Targeting of ESXi Servers with Ransomware. Retrieved March 26, 2025.
- US-CERT. (2018, April 20). Alert (TA18-106A) Russian State-Sponsored Cyber Actors Targeting Network Infrastructure Devices. Retrieved October 19, 2020.
- Zhongyuan Hau (Aaron), Ren Jie Yow, and Yoav Mazor. (2025, January 21). ESXi Ransomware Attacks: Stealthy Persistence through. Retrieved March 27, 2025.
Frequently Asked Questions
What is T1057 (Process Discovery)?
T1057 is a MITRE ATT&CK technique named 'Process Discovery'. It belongs to the Discovery tactic(s). Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within th...
How can T1057 be detected?
Detection of T1057 (Process Discovery) typically involves monitoring system logs, network traffic, and endpoint telemetry. Use SIEM rules, EDR solutions, and behavioral analytics to identify suspicious activity associated with this technique.
What mitigations exist for T1057?
Follow defense-in-depth principles including network segmentation, least privilege access, security monitoring, and regular patching to reduce the risk of this technique.
Which threat groups use T1057?
Known threat groups using T1057 include: APT38, APT3, Kimsuky, Volt Typhoon, HAFNIUM, MuddyWater, Gamaredon Group, TeamTNT.