Procedure examples

APT37's Freenki malware lists running processes using the Microsoft Windows API.

OilRig has run tasklist on a victim's machine and used infostealers to capture processes.

Higaisa’s shellcode attempted to find the process ID of the current process.

Tropic Trooper is capable of enumerating the running processes on the system using pslist.

Ke3chang performs process discovery using tasklist commands.

APT1 gathered a list of running processes on the system using tasklist /v.

Turla surveys a system upon check-in to discover running processes using the tasklist /v command. Turla RPC backdoors have also enumerated processes associated with specific open ports or named pipes.

Storm-0501 has discovered running processes through `tasklist.exe`.

After compromising a victim, Poseidon Group lists all running processes.

Stealth Falcon malware gathers a list of running processes.

Chimera has used tasklist to enumerate processes.

MirrorFace has used Tasklist on compromised hosts for discovery.

Medusa Group has utilized a hard-coded security tool process list that identifies and terminates using an undocumented IOCTL code 0x222094.

Darkhotel malware can collect a list of running processes on a system.

Deep Panda uses the Microsoft Tasklist utility to list processes running on systems.

Windshift has used malware to enumerate active processes.

ToddyCat has run `cmd /c start /b tasklist` to enumerate processes.

An APT28 loader Trojan will enumerate the victim's processes searching for explorer.exe if its current process does not have necessary permissions.

APT5 has used Windows-based utilities to carry out tasks including tasklist.exe.

Winnti Group looked for a specific process running on infected servers.

Several Lazarus Group malware families gather a list of running processes on a victim system and send it to their C2 server. A Destover-like variant used by Lazarus Group also gathers process times.

Earth Lusca has used Tasklist to obtain information from a compromised host.

Molerats actors obtained a list of active processes on the victim and sent them to C2 servers.

Inception has used a reconnaissance module to identify active processes and other associated loaded modules.

Play has used the information stealer Grixba to check for a list of security processes.

HEXANE has enumerated processes on targeted systems.

Magic Hound malware can list running processes.

TrickBot uses module networkDll for process list discovery.

PowerDuke has a command to list the victim's processes.

EKANS looks for processes from a hard-coded list.

Ninja can enumerate processes on a targeted host.

RCSession can identify processes based on PID.

SynAck enumerates all running processes.

Bumblebee can identify processes associated with analytical tools.

BRICKSTORM has the ability to check if it is running as an active child process through the detection of a specific environment variable.

Proxysvc lists processes running on the system.

Orz can gather a process list from the victim.

yty gets an output of running processes using the tasklist command.

Backdoor.Oldrea collects information about running processes.

RotaJakiro can monitor the `/proc/[PID]` directory of known RotaJakiro processes as a part of its persistence when executing with non-root permissions. If the process is found dead, it resurrects the process. RotaJakiro processes can be matched to an associated Advisory Lock, in the `/proc/locks` folder, to ensure it doesn't spawn more than one process.

AvosLocker has discovered system processes by calling `RmGetList`.

Get2 has the ability to identify running processes on an infected host.

POWRUNER may collect process information by running tasklist on a victim.

KOPILUWAK can enumerate current running processes on the targeted machine.

PAKLOG has detected and logged the full path of processes active in the foreground using Windows API calls.

COATHANGER will query running process information to determine subsequent program execution flow.

Sardonic has the ability to execute the `tasklist` command.

HALFBAKED can obtain information about running processes on the victim.

KEYMARBLE can obtain a list of running processes on the system.

Ursnif has gathered information about running processes.