Procedure examples

Kwampirs collects a list of running services with the command tasklist /v.

LAMEHUG can gather process information on targeted systems.

LookBack can list running processes.

Clop can enumerate all processes on the victim's machine.

PoetRAT has the ability to list all running processes.

FELIXROOT collects a list of running processes.

ZxShell has a command, ps, to obtain a listing of processes on the system.

SPAWNCHIMERA has searched for running processes to include web or dsmdm.

BabyShark has executed the tasklist command.

Cannon can obtain a list of processes running on the system.

Winnti for Windows can check if the explorer.exe process is responsible for calling its install function.

BLACKCOFFEE has the capability to discover processes.

Kinsing has used ps to list processes.

Meteor can check if a specific process is running, such as Kaspersky's `avp.exe`.

njRAT can search a list of running processes for Tr.exe.

ZIPLINE can identify running processes and their names.

Maze has gathered all of the running system processes.

HIUPAN has conducted process discovery to identify the PUBLOAD malware under the process WCBrowserWatcher.exe and will launch it from an install directory if it is not found.

ChChes collects its process identifier (PID) on the victim.

PowerStallion has been used to monitor process lists.

JPIN can list running processes.

metaMain can enumerate the processes that run on the platform.

Heyoka Backdoor can gather process information.

LunarWeb has used shell commands to list running processes.

KillDisk has called GetCurrentProcess.

Qilin can define specific processes to be terminated or left alone at execution.

SoreFang can enumerate processes on a victim machine through use of Tasklist.

Socksbot can list all running processes.

Agent Tesla can list the current running processes on the system.

Pasam creates a backdoor through which remote attackers can retrieve lists of running processes.

POWERSTATS has used get_tasklist to discover processes on the compromised host.

Linfo creates a backdoor through which remote attackers can retrieve a list of running processes.

Goopy has checked for the Google Updater process to ensure Goopy was loaded properly.

ShadowPad has collected the PID of a malicious process.

Astaroth searches for different processes on the system.

QakBot has the ability to check running processes.

SYSCON has the ability to use Tasklist to list running processes.

Gelsemium can enumerate running processes.

jRAT can query and kill system processes.

Helminth has used Tasklist to get information on processes.

The OsInfo function in Komplex collects a running process list.

INC Ransomware can use the Microsoft Win32 Restart Manager to kill processes with a specific handle or that are accessing resources it wants to encrypt.

Waterbear can identify the process for a specific security product.

Comnie uses the tasklist to view running processes on the victim’s machine.

Lizar has a plugin designed to obtain a list of processes.

Dtrack’s dropper can list all running processes.

LoudMiner used the ps command to monitor the running processes on the system.

Azorult can collect a list of running processes by calling CreateToolhelp32Snapshot.

BACKSPACE may collect information about running processes.

Zox has the ability to list processes.