ATT&CKProcedure examples

Procedure examples

Real-world descriptions of how a group, tool or campaign used a technique.

Technique: T1057×

268 examples

Technique	Used by	Procedure example
T1057 Process Discovery	MalwareADVSTORESHELL	ADVSTORESHELL can list running processes. ESET Sednit Part 2
T1057 Process Discovery	MalwareWarzoneRAT	WarzoneRAT can obtain a list of processes on a compromised host. Check Point Warzone Feb 2020
T1057 Process Discovery	MalwareSLOTHFULMEDIA	SLOTHFULMEDIA has enumerated processes by ID, name, or privileges. CISA MAR SLOTHFULMEDIA October 2020
T1057 Process Discovery	ToolShimRatReporter	ShimRatReporter listed all running processes on the machine. FOX-IT May 2016 Mofang
T1057 Process Discovery	ToolSILENTTRINITY	SILENTTRINITY can enumerate processes, including properties to determine if they have the Common Language Runtime (CLR) loaded. GitHub SILENTTRINITY Modules July 2019
T1057 Process Discovery	ToolPowerSploit	PowerSploit's `Get-ProcessTokenPrivilege` Privesc-PowerUp module can enumerate privileges for a given process. GitHub PowerSploit May 2012 PowerSploit Documentation
T1057 Process Discovery	ToolTasklist	Tasklist can be used to discover processes running on a system. Microsoft Tasklist
T1057 Process Discovery	ToolEmpire	Empire can find information about processes running on local and remote systems. Github PowerShell Empire Talos Frankenstein June 2019
T1057 Process Discovery	ToolPcShare	PcShare can obtain a list of running processes on a compromised host. Bitdefender FunnyDream Campaign November 2020
T1057 Process Discovery	ToolAsyncRAT	AsyncRAT can examine running processes to determine if a debugger is present. Telefonica Snip3 December 2021
T1057 Process Discovery	ToolBrute Ratel C4	Brute Ratel C4 can enumerate all processes and locate specific process IDs (PIDs). Palo Alto Brute Ratel July 2022
T1057 Process Discovery	ToolRemcos	Remcos can discover running processes on compromised machines. Fortinet Remcos Campaign NOV 2024
T1057 Process Discovery	ToolImminent Monitor	Imminent Monitor has a "Process Watcher" feature to monitor processes in case the client ever crashes or gets closed. Imminent Unit42 Dec2019
T1057 Process Discovery	ToolDonut	Donut includes subprojects that enumerate and identify information about Process Injection candidates. Donut Github
T1057 Process Discovery	ToolIronNetInjector	IronNetInjector can identify processes via C# methods such as `GetProcessesByName` and running Tasklist with the Python `os.popen` function. Unit 42 IronNetInjector February 2021
T1057 Process Discovery	ToolPupy	Pupy can list the running processes and get the process ID and parent process’s ID. GitHub Pupy
T1057 Process Discovery	MalwareTeamPCP Cloud Stealer	TeamPCP Cloud Stealer can locate GitHub Actions runner processes. Aqua Security Blog Trivy Compromise APR 2026 Aqua Security Trivy Compromise MAR 2026 Wiz TeamPCP KICS MAR 2026 Wiz Trivy Compromise MAR 2026
T1057 Process Discovery	MalwareDuqu	The discovery modules used with Duqu can collect information on process details. Symantec W32.Duqu

First Previous Page 6 of 6

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.