Procedure examples

DUSTTRAP can enumerate running processes.

BADHATCH can retrieve a list of running processes from a compromised machine.

Machete has a component to check for running processes to look for web browsers.

Avenger has the ability to use Tasklist to identify running processes.

PUBLOAD has used `tasklist` to gather running processes on victim host. PUBLOAD has also leveraged the `OpenEventA` Windows API function to check whether the same process was already running.

SystemBC has the ability to enumerate running processes.

Dacls can collect data on running and parent processes.

Woody RAT can call `NtQuerySystemProcessInformation` with `SystemProcessInformation` to enumerate all running processes, including associated information such as PID, parent PID, image name, and owner.

Mafalda can enumerate running processes on a machine.

ELMER is capable of performing process listings.

ShrinkLocker checks whether the Bitlocker Drive Encryption Tools service is running.

SombRAT can use the getprocesslist command to enumerate processes on a compromised host.

Cuckoo Stealer can use `ps aux` to enumerate running processes.

MobileOrder has a command to upload information about all running processes to its C2 server.

InvisiMole can obtain a list of running processes.

Apostle retrieves a list of all running processes on a victim host, and stops all services containing the string "sql," likely to propagate ransomware activity to database files.

Volgmer can gather a list of processes.

WINERACK can enumerate processes.

FruitFly has the ability to list processes on the system.

Skidmap has monitored critical processes to ensure resiliency.

Bonadan can use the ps command to discover other cryptocurrency miners active on the system.

Conti can enumerate through all open processes to search for any that have the string “sql” in their process name.

Raspberry Robin can identify processes running on the victim machine, such as security software, during execution.

Mispadu can enumerate the running processes on a compromised host.

Megazord can terminate a list of specified services and processes.

Diavol has used `CreateToolhelp32Snapshot`, `Process32First`, and `Process32Next` API calls to enumerate the running processes in the system.

Doki has searched for the current process’s PID.

Fysbis can collect information about running processes.

VERMIN can get a list of the processes and running tasks on the system.

UBoatRAT can list running processes on the system.

Nightdoor can collect information on installed applications via Windows registry keys, as well as collecting information on running processes.

MarkiRAT can search for different processes on a system.

PowerShower has the ability to deploy a reconnaissance module to retrieve a list of the active processes.

Kazuar obtains a list of running processes through WMI querying and the ps command.

NavRAT uses tasklist /v to check running processes.

DarkComet can list active processes running on the victim’s machine.

NETEAGLE can send process listings over the C2 channel.

POORAIM can enumerate processes.

CHIMNEYSWEEP can check if a process name contains “creensaver.”

FatDuke can list running processes on the localhost.

Lucifer can identify the process that owns remote connections.

BlackEnergy has gathered a process list by using Tasklist.exe.

DRATzarus can enumerate and examine running processes to determine if a debugger is present.

Rising Sun can enumerate all running processes and process information on an infected machine.

ObliqueRAT can check for blocklisted process names on a compromised host.

SHOTPUT has a command to obtain a process listing.

Avaddon has collected information about running processes.

SocGholish can list processes on targeted hosts.

Flagpro has been used to run the tasklist command on a compromised system.

XAgentOSX contains the getProcessList function to run ps aux to get running processes.