Procedure examples

If sent the command `16002`, LightSpy uses the `NSWorkspace runningApplications()` method to collect the process ID, path to the executable, bundle information, and the filename of the executable for all running applications.

HELLOKITTY can search for specific processes to terminate.

DarkTortilla can enumerate a list of running processes on a compromised system.

ROKRAT can list the current running processes on the system.

Babuk has the ability to check running processes on a targeted system.

Javali can monitor processes for open browsers and custom banking applications.

BBSRAT can list running processes.

PlugX has a module to list the processes running on a machine.

Bisonal can obtain a list of running processes on the victim’s machine.

DustySky collects information about running processes from victims.

Remsec can obtain a process list from the victim.

Industroyer2 has the ability to cyclically enumerate running processes such as PServiceControl.exe, PService_PDD.exe, and other targets supplied through a hardcoded configuration.

Sykipot may gather a list of running processes by running tasklist /v.

Epic uses the tasklist /v command to obtain a list of processes.

Cuba can enumerate processes running on a victim's machine.

Clambling can enumerate processes on a targeted system.

PureCrypter can enumerate processes on compromised hosts.

Akira verifies the deletion of volume shadow copies by checking for the existence of the process ID related to the process created to delete these items.

DarkGate performs various checks for running processes, including security software by looking for hard-coded process name values.

LockBit 3.0 can identify and terminate specific services.

SVCReady can collect a list of running processes from an infected host.

ThiefQuest obtains a list of running processes using the function kill_unwanted.

FoggyWeb's loader can enumerate all Common Language Runtimes (CLRs) and running Application Domains in the compromised AD FS server's Microsoft.IdentityServer.ServiceHost.exe process.

Carbanak lists running processes.

Hydraq creates a backdoor through which remote attackers can monitor processes.

Caterpillar WebShell can gather a list of processes running on the machine.

Elise enumerates processes via the tasklist command.

USBferry can use tasklist to gather information about the process running on the infected system.

TSCookie has the ability to list processes on the infected host.

Latrodectus can enumerate running processes including process grandchildren on targeted hosts.

Saint Bot has enumerated running processes on a compromised host to determine if it is running under the process name `dfrgui.exe`.

LODEINFO can kill a process using specific process ID.

CharmPower has the ability to list running processes through the use of `tasklist`.

MuddyViper has the ability to collect running processes.

Bundlore has used the ps command to list processes.

P8RAT can check for specific processes associated with virtual environments.

Sagerunex identifies the `explorer.exe` process on the executing system.

TAINTEDSCRIBE can execute ProcessList for process discovery.

LP-Notes has searched for the process taskhostw.exe.

Royal can use `GetCurrentProcess` to enumerate processes.

Uroburos can use its `Process List` command to enumerate processes on compromised hosts.

Metamorfo has performed process name checks and has monitored applications.

Embargo has utilized MS4Killer to detect running processes on the victim device. Embargo has also captured a snapshot of active running processes using the Windows API `CreateToolHelp32Snapshot()`.

Trojan.Karagany can use Tasklist to collect a list of running tasks.

PipeMon can iterate over the running processes to find a suitable injection target.

KONNI has used the command cmd /c tasklist to get a snapshot of the current processes on the target machine.

gh0st RAT has the capability to list processes.

JHUHUGIT obtains a list of running processes on the victim.

BLUELIGHT can collect process filenames and SID authority level.

down_new has the ability to list running processes on a compromised host.