Procedure examples

Bundlore prompts the user for their credentials.

LP-Notes has displayed a fake Windows Security dialog box to prompt for Windows credentials.

Metamorfo has displayed fake forms on top of banking sites to intercept credentials from victims.

Calisto presents an input prompt asking for the user's login and password.

Proton prompts users for their credentials.

XCSSET prompts the user to input credentials using a native macOS dialog box leveraging the system process /Applications/Safari.app/Contents/MacOS/SafariForWebKitDevelopment.

Dok prompts the user for credentials.

SILENTTRINITY's `credphisher.py` module can prompt a current user for their credentials.

In the Triton Safety Instrumented System Attack, TEMP.Veles captured credentials as they were being changed by redirecting text-based login codes to websites they controlled.

During Cutting Edge, threat actors modified the JavaScript loaded by the Ivanti Connect Secure login page to capture credentials entered.

Kimsuky has collected credentials from a fake Google account login page.

Winter Vivern registered and hosted domains to allow for creation of web pages mimicking legitimate government email logon sites to collect logon information.

WARPWIRE can capture credentials submitted during the web logon process in order to access layer seven applications such as RDP.

The IceApple OWA credential logger can monitor for OWA authentication requests and log the credentials.

PLATINUM is capable of using Windows hook interfaces for information gathering such as credential access.

TrickBot has the ability to capture RDP credentials by capturing the CredEnumerateA API

RDFSNIFFER hooks several Win32 API functions to hijack elements of the remote system management user-interface.

NOKKI uses the Windows call SetWindowsHookEx and begins injecting it into every GUI process running on the victim's machine.

VersaMem hooked and overrided Versa's built-in authentication method, `setUserPassword`, to intercept plaintext credentials when submitted to the server.

Ursnif has hooked APIs to perform a wide variety of information theft, such as monitoring traffic from browsers.

Zeus Panda hooks processes by leveraging its own IAT hooked functions.

Zebrocy installs an application-defined Windows hook to get notified when a network drive has been attached, so it can then use the hook to call its RecordToFile file stealing method.

FinFisher hooks processes by modifying IAT pointers to CreateWindowEx.

Carberp has hooked several Windows API functions to steal credentials.

ZxShell hooks several API functions to spawn system threads.

Empire contains some modules that leverage API hooking to carry out tasks, such as netripper.

Scripts associated with KV Botnet Activity initial deployment can identify processes related to security tools and other botnet families for follow-on disabling during installation.

During Frankenstein, the threat actors used Empire to obtain a list of all running processes.

During RedPenguin, UNC3886 used malware capable of reading the PID for the Junos OS snmpd daemon.

During Operation Honeybee, the threat actors obtained a list of running processes on a victim machine using `cmd /c tasklist > %temp%\temp.ini`.

During C0015, the threat actors used the `tasklist /s` command as well as `taskmanager` to obtain a list of running processes.

During the SolarWinds Compromise, APT29 used multiple command-line utilities to enumerate running processes.

During FunnyDream, the threat actors used Tasklist on targeted systems.

During Operation CuckooBees, the threat actors used the `tasklist` command as part of their advanced reconnaissance.

During the 2025 Poland Wiper Attacks, the adversaries enumerated current running processes using `tasklist`.

During Operation Wocao, the threat actors used `tasklist` to collect a list of running processes on an infected system.

APT38 leveraged Sysmon to understand the processes, services in the organization.

APT3 has a tool that can list out currently running processes.

Kimsuky can gather a list of all processes running on a victim's machine. Kimsuky has also obtained running processes on the victim device utilizing PowerShell cmdlet `Get-Process`.

Volt Typhoon has enumerated running processes on targeted systems including through the use of Tasklist.

HAFNIUM has used `tasklist` to enumerate processes.

MuddyWater has used malware to obtain a list of running processes on the system.

Gamaredon Group has used tools to enumerate processes on target hosts including Process Explorer.

TeamTNT has searched for rival malware and removes it if found. TeamTNT has also searched for running processes containing the strings aliyun or liyun to identify machines running Alibaba Cloud Security tools.

FIN7 has used the PowerShell script 3CF9.ps1 to perform process discovery by executing `tasklist /v`. Additionally, WsTaskLoad.exe executes `tasklist /v` to perform process discovery.

Andariel has used tasklist to enumerate processes and find a specific string.

Sidewinder has used tools to identify running processes on the victim's machine.

Mustang Panda has used tasklist /v to determine active process information. Mustang Panda has also used TONESHELL malware to check the process name and process path to ensure it matches the expected one prior to triggering a custom exception handler.

Rocke can detect a running process's PID on the infected machine.

UNC3886 has run scripts to list all running processes on a guest VM from an ESXi host.