Procedure examples

TrickBot uses module networkDll for process list discovery.

PowerDuke has a command to list the victim's processes.

EKANS looks for processes from a hard-coded list.

Ninja can enumerate processes on a targeted host.

RCSession can identify processes based on PID.

SynAck enumerates all running processes.

Bumblebee can identify processes associated with analytical tools.

BRICKSTORM has the ability to check if it is running as an active child process through the detection of a specific environment variable.

Proxysvc lists processes running on the system.

Orz can gather a process list from the victim.

yty gets an output of running processes using the tasklist command.

Backdoor.Oldrea collects information about running processes.

RotaJakiro can monitor the `/proc/[PID]` directory of known RotaJakiro processes as a part of its persistence when executing with non-root permissions. If the process is found dead, it resurrects the process. RotaJakiro processes can be matched to an associated Advisory Lock, in the `/proc/locks` folder, to ensure it doesn't spawn more than one process.

AvosLocker has discovered system processes by calling `RmGetList`.

Get2 has the ability to identify running processes on an infected host.

POWRUNER may collect process information by running tasklist on a victim.

KOPILUWAK can enumerate current running processes on the targeted machine.

PAKLOG has detected and logged the full path of processes active in the foreground using Windows API calls.

COATHANGER will query running process information to determine subsequent program execution flow.

Sardonic has the ability to execute the `tasklist` command.

HALFBAKED can obtain information about running processes on the victim.

KEYMARBLE can obtain a list of running processes on the system.

Ursnif has gathered information about running processes.

RansomHub can stop processes associated with files currently in use to maximize the impact of encryption.

Zeus Panda checks for running processes on the victim’s machine.

GeminiDuke collects information on running processes and environment variables from the victim.

Havoc can enumerate processes on targeted hosts.

FrameworkPOS can enumerate and exclude selected processes on a compromised host to speed execution of memory scraping.

GravityRAT lists the running processes on the system.

InvisibleFerret has the capability to query installed programs and running processes. InvisibleFerret has also identified running processes using the Python project “psutil”.

Bankshot identifies processes and collects the process ids.

StrongPity can determine if a user is logged in by checking to see if explorer.exe is running.

PLAINTEE performs the tasklist command to list running processes.

WinMM sets a WH_CBT Windows hook to collect information on process creation.

Nebulae can enumerate processes on a target system.

TONESHELL has checked the process name and process path to ensure it matches the expected one prior to triggering a custom exception handler. TONESHELL has also searched for running antivirus processes to include ESET’s antivirus associated executables ekrn.exe and egui.exe.

UPSTYLE has the ability to read `/proc/self/cmdline` to see if it is running as a monitored process.

Kasidet has the ability to search for a given process name in processes currently running in the system.

OceanSalt can collect the name and ID for every process running on the system.

Brave Prince lists the running processes.

Medusa Ransomware has utilized an encoded list of the processes that it detects and terminates.

RainyDay can enumerate processes on a target system.

AppleSeed can enumerate the current process on a compromised host.

macOS.OSAMiner has used `ps ax | grep <name> | grep -v grep | ...` and `ps ax | grep -E...` to conduct process discovery.

NETWIRE can discover processes on compromised hosts.

iKitten lists the current processes running.

Bad Rabbit can enumerate all running processes to compare hashes.

Aria-body has the ability to enumerate loaded modules for a process..

Emotet has been observed enumerating local processes.

Crimson contains a command to list processes.