Process Discovery

4H RAT has the capability to obtain a listing of running processes (including loaded modules).^[90]

ADVSTORESHELL can list running processes.^[49]

Agent Tesla can list the current running processes on the system.^[57]

APT1 gathered a list of running processes on the system using tasklist /v.^[138]

An APT28 loader Trojan will enumerate the victim's processes searching for explorer.exe if its current process does not have necessary permissions.^[38]

APT3 has a tool that can list out currently running processes.^[141][142]

APT37's Freenki malware lists running processes using the Microsoft Windows API.^[136]

APT38 leveraged Sysmon to understand the processes, services in the organization.^[139]

Aria-body has the ability to enumerate loaded modules for a process.^[125].

Astaroth searches for different processes on the system. ^[102]

Avenger has the ability to use Tasklist to identify running processes.^[129]

Azorult can collect a list of running processes by calling CreateToolhelp32Snapshot.^[64][65]

BabyShark has executed the tasklist command.^[112]

Backdoor.Oldrea collects information about running processes.^[16]

BACKSPACE may collect information about running processes.^[17]

Bankshot identifies processes and collects the process ids.^[46]

BBSRAT can list running processes.^[26]

BISCUIT has a command to enumerate running processes and identify their owners.^[76]

Bisonal can obtain a list of running processes on the victim’s machine.^[39]

BLACKCOFFEE has the capability to discover processes.^[61]

BlackEnergy has gathered a process list by using Tasklist.exe.^[35][36][37]

Brave Prince lists the running processes.^[56]

Bundlore has used the ps command to list processes.^[134]

Cannon can obtain a list of processes running on the system.^[30][31]

Carbanak lists running processes.^[34]

Carbon can list the processes on the victim’s machine.^[71]

Cardinal RAT contains watchdog functionality that ensures its process is always running, else spawns a new instance.^[77]

ChChes collects its process identifier (PID) on the victim.^[62]

Cobalt Strike's "beacon" payload can collect information on process details.^[2]

Comnie uses the tasklist to view running processes on the victim’s machine.^[10]

Crimson contains a command to list processes.^[44]

DarkComet can list active processes running on the victim’s machine.^[70]

Darkhotel has searched for anti-malware strings and anti-virus processes running on the system.^[152]

Deep Panda uses the Microsoft Tasklist utility to list processes running on systems.^[144]

Derusbi collects current and parent process IDs.^[47][48]

down_new has the ability to list running processes on a compromised host.^[129]

The discovery modules used with Duqu can collect information on process details.^[87]

DustySky collects information about running processes from victims.^[14][15]

Elise enumerates processes via the tasklist command.^[66]

ELMER is capable of performing process listings.^[20]

Emotet has been observed enumerating local processes.^[101]

Empire can find information about processes running on local and remote systems.^[6]

Epic uses the tasklist /v command to obtain a list of processes.^[74][75]

EvilBunny has used EnumProcesses() to identify how many process are running in the environment.^[108]

FELIXROOT collects a list of running processes.^[83]

Final1stspy obtains a list of running processes.^[84]

FinFisher checks its parent process for indications that it is running in a sandbox setup.^[88][89]

Frankenstein has enumerated hosts, looking to obtain a list of all currently running processes.^[157]

FruitFly has the ability to list processes on the system.^[25]

Fysbis can collect information about running processes.^[111]

GeminiDuke collects information on running processes and environment variables from the victim.^[32]

Get2 has the ability to identify running processes on an infected host.^[126]

gh0st RAT has the capability to list processes.^[94]

Gold Dragon checks the running processes on the victim’s machine.^[56]

Goopy has checked for the Google Updater process to ensure Goopy was loaded properly.^[133]

GravityRAT lists the running processes on the system.^[54]

HALFBAKED can obtain information about running processes on the victim.^[73]

Helminth has used Tasklist to get information on processes.^[38]

Honeybee gathers a list of processes using the tasklist command and then is sent back to the control server.^[137]

HotCroissant has the ability to list running processes on the infected host.^[115]

Hydraq creates a backdoor through which remote attackers can monitor processes.^[58][59]

iKitten lists the current processes running.^[25]

Imminent Monitor has a "Process Watcher" feature to monitor processes in case the client ever crashes or gets closed.^[7]

Inception has used a reconnaissance module to identify active processes and other associated loaded modules.^[156]

InvisiMole obtains a list of running processes.^[12]

Ixeshe can list running processes.^[106]

JHUHUGIT obtains a list of running processes on the victim.^[91][92]

JPIN can list running processes.^[9]

jRAT can query and kill system processes.^[103]

Kasidet has the ability to search for a given process name in processes currently running in the system.^[97]

Kazuar obtains a list of running processes through WMI querying and the ps command.^[41]

Ke3chang performs process discovery using tasklist commands.^[145][146]

KEYMARBLE can obtain a list of running processes on the system.^[24]

The OsInfo function in Komplex collects a running process list.^[79]

KONNI has used tasklist.exe to get a snapshot of the current processes’ state of the target machine.^[114]

Kwampirs collects a list of running services with the command tasklist /v.^[45]

Several Lazarus Group malware families gather a list of running processes on a victim system and send it to their C2 server. A Destover-like variant used by Lazarus Group also gathers process times.^{[147][148][149][43]}

Linfo creates a backdoor through which remote attackers can retrieve a list of running processes.^[85]

LoudMiner used the ps command to monitor the running processes on the system.^[123]

Machete has a component to check for running processes to look for web browsers.^[109]

Magic Hound malware can list running processes.^[153]

MAZE has gathered all of the running system processes.^[121]

Metamorfo has performed process name checks and has monitored applications.^[132]

MobileOrder has a command to upload information about all running processes to its C2 server.^[72]

Molerats actors obtained a list of active processes on the victim and sent them to C2 servers.^[14]

MoonWind has a command to return a list of running processes.^[80]

Mosquito runs tasklist to obtain running processes.^[22]

MuddyWater has used malware to obtain a list of running processes on the system.^[154][155]

NavRAT uses tasklist /v to check running processes.^[33]

NETEAGLE can send process listings over the C2 channel.^[17]

OceanSalt can collect the name and ID for every process running on the system.^[29]

OilRig has run tasklist on a victim's machine.^[135]

Orz can gather a process list from the victim.^[23]

Pasam creates a backdoor through which remote attackers can retrieve lists of running processes.^[55]

PLAINTEE performs the tasklist command to list running processes.^[40]

PLEAD has the ability to list processes on the compromised host.^[116]

PlugX has a module to list the processes running on a machine.^[18]

PoetRAT has the ability to list all running processes.^[113]

POORAIM can enumerate processes.^[19]

After compromising a victim, Poseidon Group lists all running processes.^[143]

PowerDuke has a command to list the victim's processes.^[21]

PowerShower has the ability to deploy a reconnaissance module to retrieve a list of the active processes.^[118]

PowerSploit's Get-ProcessTokenPrivilege Privesc-PowerUp module can enumerate privileges for a given process.^[3][4]

PowerStallion has been used to monitor process lists.^[107]

POWERSTATS has used get_tasklist to discover processes on the compromised host.^[122]

POWRUNER may collect process information by running tasklist on a victim.^[28]

Proxysvc lists processes running on the system.^[43]

Pupy can list the running processes and get the process ID and parent process’s ID.^[1]

RATANKBA lists the system’s processes.^[50][51]

Remsec can obtain a process list from the victim.^[86]

Rising Sun can enumerate all running processes and process information on an infected machine.^[120]

Rocke can detect a running process's PID on the infected machine.^[158]

RogueRobin checks the running processes for evidence it may be running in a sandbox environment. It specifically enumerates processes for Wireshark and Sysinternals.^[82]

ROKRAT lists the current running processes on the system.^[68][69]

RTM can obtain information about process integrity levels.^[11]

Ryuk has called CreateToolhelp32Snapshot to enumerate all running processes.^[119]

Seasalt has a command to perform a process listing.^[76]

ShimRatReporter listed all running processes on the machine.^[8]

SHOTPUT has a command to obtain a process listing.^[13]

Skidmap has monitored critical processes to ensure resiliency.^[131]

Socksbot can list all running processes.^[93]

Stealth Falcon malware gathers a list of running processes.^[151]

StreamEx has the ability to enumerate processes.^[78]

Sykipot may gather a list of running processes by running tasklist /v.^[42]

SynAck enumerates all running processes.^[52][53]

SYSCON has the ability to use Tasklist to list running processes.^[127]

TajMahal has the ability to identify running processes and associated plugins on an infected host.^[128]

Tasklist can be used to discover processes running on a system.^[5]

Trojan.Karagany can use tasklist to collect a list of running tasks.^[16]

Tropic Trooper is capable of enumerating the running processes on the system using pslist.^[150][124]

TSCookie has the ability to list processes on the infected host.^[117]

Turla surveys a system upon check-in to discover running processes using the tasklist /v command.^[74] Turla RPC backdoors have also enumerated processes associated with specific open ports or named pipes.^[107]

UBoatRAT can list running processes on the system.^[27]

Ursnif has gathered information about running processes.^[104][105]

USBferry can use tasklist to gather information about the process running on the infected system.^[124]

Valak has the ability to enumerate running processes on a compromised host.^[130]

VERMIN can get a list of the processes and running tasks on the system.^[63]

Volgmer can gather a list of processes.^[67]

WINERACK can enumerate processes.^[19]

WinMM sets a WH_CBT Windows hook to collect information on process creation.^[95]

Winnti Group looked for a specific process running on infected servers.^[140]

XAgentOSX contains the getProcessList function to run ps aux to get running processes.^[60]

yty gets an output of running processes using the tasklist command.^[81]

Zebrocy uses the tasklist and wmic process get Capture, ExecutablePath commands to gather the processes running on the system.^{[30][98][31][99][100]}

Zeus Panda checks for running processes on the victim’s machine.^[96]

ZxShell has a command, ps, to obtain a listing of processes on the system.^[110]