Procedure examples

Lizar has a plugin designed to obtain a list of processes.

Dtrack’s dropper can list all running processes.

LoudMiner used the ps command to monitor the running processes on the system.

Azorult can collect a list of running processes by calling CreateToolhelp32Snapshot.

BACKSPACE may collect information about running processes.

Zox has the ability to list processes.

ADVSTORESHELL can list running processes.

WarzoneRAT can obtain a list of processes on a compromised host.

SLOTHFULMEDIA has enumerated processes by ID, name, or privileges.

ShimRatReporter listed all running processes on the machine.

SILENTTRINITY can enumerate processes, including properties to determine if they have the Common Language Runtime (CLR) loaded.

PowerSploit's Get-ProcessTokenPrivilege Privesc-PowerUp module can enumerate privileges for a given process.

Tasklist can be used to discover processes running on a system.

Empire can find information about processes running on local and remote systems.

PcShare can obtain a list of running processes on a compromised host.

AsyncRAT can examine running processes to determine if a debugger is present.

Brute Ratel C4 can enumerate all processes and locate specific process IDs (PIDs).

Remcos can discover running processes on compromised machines.

Imminent Monitor has a "Process Watcher" feature to monitor processes in case the client ever crashes or gets closed.

Donut includes subprojects that enumerate and identify information about Process Injection candidates.

IronNetInjector can identify processes via C# methods such as GetProcessesByName and running Tasklist with the Python os.popen function.

Pupy can list the running processes and get the process ID and parent process’s ID.

TeamPCP Cloud Stealer can locate GitHub Actions runner processes.

The discovery modules used with Duqu can collect information on process details.

NICECURL has provided an arbitrary command execution interface.

Get2 has the ability to run executables with command-line arguments.

VersaMem was delivered as a Java Archive (JAR) that runs by attaching itself to the Apache Tomcat Java servlet and web server.

Zeus Panda can launch remote scripts on the victim’s machine.

Matryoshka is capable of providing Meterpreter shell access.

P.A.S. Webshell has the ability to create reverse shells with Perl scripts.

WINERACK can create a reverse shell that utilizes statically-linked Wine cmd.exe code to emulate Windows command prompt commands.

Bonadan can create bind and reverse shells on the infected system.

Raspberry Robin variants can be delivered via highly obfuscated Windows Script Files (WSF) for initial execution.

DarkComet can execute various types of scripts on the victim’s machine.

MuddyViper has launched a reverse shell using a provided command line.

Bandook can support commands to execute Java-based payloads.

gh0st RAT is able to open a remote shell to execute commands.

SpeakUp uses Perl scripts.

Kessel can create a reverse shell between the infected host and a specified system.

CHOPSTICK is capable of performing remote command execution.

SLIGHTPULSE contains functionality to execute arbitrary commands passed to it.

StarProxy has used the command line for execution of commands.

FIVEHANDS can receive a command line argument to limit file encryption to specified directories.

Empire uses a command-line interface to interact with systems.

Imminent Monitor has a CommandPromptPacket and ScriptPacket module(s) for creating a remote shell and executing scripts.

Donut can generate shellcode outputs that execute via Ruby.

ZeroCleare can receive command line arguments from an operator to corrupt the file system using the RawDisk driver.

TrickBot has been known to use PowerShell to download new payloads, open documents, and upload data to command and control servers.

Bumblebee can use PowerShell for execution.

GRIFFON has used PowerShell to execute the Meterpreter downloader TinyMet.