Procedure examples

Ixeshe can list running processes.

4H RAT has the capability to obtain a listing of running processes (including loaded modules).

RogueRobin checks the running processes for evidence it may be running in a sandbox environment. It specifically enumerates processes for Wireshark and Sysinternals.

StreamEx has the ability to enumerate processes.

NightClub has the ability to use `GetWindowThreadProcessId` to identify the process behind a specified window.

SDBbot can enumerate a list of running processes on a compromised machine.

Mosquito runs tasklist to obtain running processes.

RTM can obtain information about process integrity levels.

Derusbi collects current and parent process IDs.

SodaMaster can search a list of running processes.

Grandoreiro can identify installed security tools based on process names.

ZxxZ has created a snapshot of running processes using `CreateToolhelp32Snapshot`.

Bazar can identity the current process on a compromised host.

RATANKBA lists the system’s processes.

MoonWind has a command to return a list of running processes.

HiddenFace can check running processes against a list of blocklisted applications.

Ryuk has called CreateToolhelp32Snapshot to enumerate all running processes.

Final1stspy obtains a list of running processes.

MgBot includes a module for establishing a process watchdog for itself, identifying if the MgBot process is still running.

LockBit 2.0 can determine if a running process has administrative privileges and terminate processes that interfere with encryption or exfiltration.

Zebrocy uses the tasklist and wmic process get Capture, ExecutablePath commands to gather the processes running on the system.

Pandora can monitor processes on a compromised host.

FinFisher checks its parent process for indications that it is running in a sandbox setup.

Cobalt Strike's Beacon payload can collect information on process details.

SUNBURST collected a list of process names that were hashed using a FNV-1a + XOR algorithm to check against similarly-hashed hardcoded blocklists.

EvilBunny has used EnumProcesses() to identify how many process are running in the environment.

HotCroissant has the ability to list running processes on the infected host.

Valak has the ability to enumerate running processes on a compromised host.

Taidoor can use GetCurrentProcessId for process discovery.

CaddyWiper can obtain a list of current processes.

Cyclops Blink can enumerate the process it is currently running under.

Seasalt has a command to perform a process listing.

TajMahal has the ability to identify running processes and associated plugins on an infected host.

PLEAD has the ability to list processes on the compromised host.

IPsec Helper can identify the process it is currently running under and its number, and pass this back to a command and control node.

Carbon can list the processes on the victim’s machine.

TRAILBLAZE has conducted process discovery by searching for specific named processes such as `/home/bin/web`.

Cardinal RAT contains watchdog functionality that ensures its process is always running, else spawns a new instance.

BISCUIT has a command to enumerate running processes and identify their owners.

Gold Dragon checks the running processes on the victim’s machine.

Ramsay can gather a list of running processes by using Tasklist.

The AshTag AshenOrchestrator component has process management functionality.

Carberp has collected a list of running processes.

NKAbuse will check victim systems to ensure only one copy of the malware is running.

Pillowmint can iterate through running processes every six seconds collecting a list of processes to capture from later.

MacMa can enumerate running processes.

FunnyDream has the ability to discover processes, including `Bka.exe` and `BkavUtil.exe`.

SUNSPOT monitored running processes for instances of MsBuild.exe by hashing the name of each running process and comparing it to the corresponding value 0x53D525. It also extracted command-line arguments and individual arguments from the running MsBuild.exe process to identify the directory path of the Orion software Visual Studio solution.

SysUpdate can collect information about running processes.

OutSteel can identify running processes on a compromised host.