Procedure examples

Mispadu can enumerate the running processes on a compromised host.

Megazord can terminate a list of specified services and processes.

Diavol has used `CreateToolhelp32Snapshot`, `Process32First`, and `Process32Next` API calls to enumerate the running processes in the system.

Doki has searched for the current process’s PID.

Fysbis can collect information about running processes.

VERMIN can get a list of the processes and running tasks on the system.

UBoatRAT can list running processes on the system.

Nightdoor can collect information on installed applications via Windows registry keys, as well as collecting information on running processes.

MarkiRAT can search for different processes on a system.

PowerShower has the ability to deploy a reconnaissance module to retrieve a list of the active processes.

Kazuar obtains a list of running processes through WMI querying and the ps command.

NavRAT uses tasklist /v to check running processes.

DarkComet can list active processes running on the victim’s machine.

NETEAGLE can send process listings over the C2 channel.

POORAIM can enumerate processes.

CHIMNEYSWEEP can check if a process name contains “creensaver.”

FatDuke can list running processes on the localhost.

Lucifer can identify the process that owns remote connections.

BlackEnergy has gathered a process list by using Tasklist.exe.

DRATzarus can enumerate and examine running processes to determine if a debugger is present.

Rising Sun can enumerate all running processes and process information on an infected machine.

ObliqueRAT can check for blocklisted process names on a compromised host.

SHOTPUT has a command to obtain a process listing.

Avaddon has collected information about running processes.

SocGholish can list processes on targeted hosts.

Flagpro has been used to run the tasklist command on a compromised system.

XAgentOSX contains the getProcessList function to run ps aux to get running processes.

If sent the command `16002`, LightSpy uses the `NSWorkspace runningApplications()` method to collect the process ID, path to the executable, bundle information, and the filename of the executable for all running applications.

HELLOKITTY can search for specific processes to terminate.

DarkTortilla can enumerate a list of running processes on a compromised system.

ROKRAT can list the current running processes on the system.

Babuk has the ability to check running processes on a targeted system.

Javali can monitor processes for open browsers and custom banking applications.

BBSRAT can list running processes.

PlugX has a module to list the processes running on a machine.

Bisonal can obtain a list of running processes on the victim’s machine.

DustySky collects information about running processes from victims.

Remsec can obtain a process list from the victim.

Industroyer2 has the ability to cyclically enumerate running processes such as PServiceControl.exe, PService_PDD.exe, and other targets supplied through a hardcoded configuration.

Sykipot may gather a list of running processes by running tasklist /v.

Epic uses the tasklist /v command to obtain a list of processes.

Cuba can enumerate processes running on a victim's machine.

Clambling can enumerate processes on a targeted system.

PureCrypter can enumerate processes on compromised hosts.

Akira verifies the deletion of volume shadow copies by checking for the existence of the process ID related to the process created to delete these items.

DarkGate performs various checks for running processes, including security software by looking for hard-coded process name values.

LockBit 3.0 can identify and terminate specific services.

SVCReady can collect a list of running processes from an infected host.

ThiefQuest obtains a list of running processes using the function kill_unwanted.

FoggyWeb's loader can enumerate all Common Language Runtimes (CLRs) and running Application Domains in the compromised AD FS server's Microsoft.IdentityServer.ServiceHost.exe process.