Procedure examples

RansomHub can stop processes associated with files currently in use to maximize the impact of encryption.

Zeus Panda checks for running processes on the victim’s machine.

GeminiDuke collects information on running processes and environment variables from the victim.

Havoc can enumerate processes on targeted hosts.

FrameworkPOS can enumerate and exclude selected processes on a compromised host to speed execution of memory scraping.

GravityRAT lists the running processes on the system.

InvisibleFerret has the capability to query installed programs and running processes. InvisibleFerret has also identified running processes using the Python project “psutil”.

Bankshot identifies processes and collects the process ids.

StrongPity can determine if a user is logged in by checking to see if explorer.exe is running.

PLAINTEE performs the tasklist command to list running processes.

WinMM sets a WH_CBT Windows hook to collect information on process creation.

Nebulae can enumerate processes on a target system.

TONESHELL has checked the process name and process path to ensure it matches the expected one prior to triggering a custom exception handler. TONESHELL has also searched for running antivirus processes to include ESET’s antivirus associated executables ekrn.exe and egui.exe.

UPSTYLE has the ability to read `/proc/self/cmdline` to see if it is running as a monitored process.

Kasidet has the ability to search for a given process name in processes currently running in the system.

OceanSalt can collect the name and ID for every process running on the system.

Brave Prince lists the running processes.

Medusa Ransomware has utilized an encoded list of the processes that it detects and terminates.

RainyDay can enumerate processes on a target system.

AppleSeed can enumerate the current process on a compromised host.

macOS.OSAMiner has used `ps ax | grep <name> | grep -v grep | ...` and `ps ax | grep -E...` to conduct process discovery.

NETWIRE can discover processes on compromised hosts.

iKitten lists the current processes running.

Bad Rabbit can enumerate all running processes to compare hashes.

Aria-body has the ability to enumerate loaded modules for a process..

Emotet has been observed enumerating local processes.

Crimson contains a command to list processes.

DUSTTRAP can enumerate running processes.

BADHATCH can retrieve a list of running processes from a compromised machine.

Machete has a component to check for running processes to look for web browsers.

Avenger has the ability to use Tasklist to identify running processes.

PUBLOAD has used `tasklist` to gather running processes on victim host. PUBLOAD has also leveraged the `OpenEventA` Windows API function to check whether the same process was already running.

SystemBC has the ability to enumerate running processes.

Dacls can collect data on running and parent processes.

Woody RAT can call `NtQuerySystemProcessInformation` with `SystemProcessInformation` to enumerate all running processes, including associated information such as PID, parent PID, image name, and owner.

Mafalda can enumerate running processes on a machine.

ELMER is capable of performing process listings.

ShrinkLocker checks whether the Bitlocker Drive Encryption Tools service is running.

SombRAT can use the getprocesslist command to enumerate processes on a compromised host.

Cuckoo Stealer can use `ps aux` to enumerate running processes.

MobileOrder has a command to upload information about all running processes to its C2 server.

InvisiMole can obtain a list of running processes.

Apostle retrieves a list of all running processes on a victim host, and stops all services containing the string "sql," likely to propagate ransomware activity to database files.

Volgmer can gather a list of processes.

WINERACK can enumerate processes.

FruitFly has the ability to list processes on the system.

Skidmap has monitored critical processes to ensure resiliency.

Bonadan can use the ps command to discover other cryptocurrency miners active on the system.

Conti can enumerate through all open processes to search for any that have the string “sql” in their process name.

Raspberry Robin can identify processes running on the victim machine, such as security software, during execution.