Procedure examples

Carbanak lists running processes.

Hydraq creates a backdoor through which remote attackers can monitor processes.

Caterpillar WebShell can gather a list of processes running on the machine.

Elise enumerates processes via the tasklist command.

USBferry can use tasklist to gather information about the process running on the infected system.

TSCookie has the ability to list processes on the infected host.

Latrodectus can enumerate running processes including process grandchildren on targeted hosts.

Saint Bot has enumerated running processes on a compromised host to determine if it is running under the process name `dfrgui.exe`.

LODEINFO can kill a process using specific process ID.

CharmPower has the ability to list running processes through the use of `tasklist`.

MuddyViper has the ability to collect running processes.

Bundlore has used the ps command to list processes.

P8RAT can check for specific processes associated with virtual environments.

Sagerunex identifies the `explorer.exe` process on the executing system.

TAINTEDSCRIBE can execute ProcessList for process discovery.

LP-Notes has searched for the process taskhostw.exe.

Royal can use `GetCurrentProcess` to enumerate processes.

Uroburos can use its `Process List` command to enumerate processes on compromised hosts.

Metamorfo has performed process name checks and has monitored applications.

Embargo has utilized MS4Killer to detect running processes on the victim device. Embargo has also captured a snapshot of active running processes using the Windows API `CreateToolHelp32Snapshot()`.

Trojan.Karagany can use Tasklist to collect a list of running tasks.

PipeMon can iterate over the running processes to find a suitable injection target.

KONNI has used the command cmd /c tasklist to get a snapshot of the current processes on the target machine.

gh0st RAT has the capability to list processes.

JHUHUGIT obtains a list of running processes on the victim.

BLUELIGHT can collect process filenames and SID authority level.

down_new has the ability to list running processes on a compromised host.

Ixeshe can list running processes.

4H RAT has the capability to obtain a listing of running processes (including loaded modules).

RogueRobin checks the running processes for evidence it may be running in a sandbox environment. It specifically enumerates processes for Wireshark and Sysinternals.

StreamEx has the ability to enumerate processes.

NightClub has the ability to use `GetWindowThreadProcessId` to identify the process behind a specified window.

SDBbot can enumerate a list of running processes on a compromised machine.

Mosquito runs tasklist to obtain running processes.

RTM can obtain information about process integrity levels.

Derusbi collects current and parent process IDs.

SodaMaster can search a list of running processes.

Grandoreiro can identify installed security tools based on process names.

ZxxZ has created a snapshot of running processes using `CreateToolhelp32Snapshot`.

Bazar can identity the current process on a compromised host.

RATANKBA lists the system’s processes.

MoonWind has a command to return a list of running processes.

HiddenFace can check running processes against a list of blocklisted applications.

Ryuk has called CreateToolhelp32Snapshot to enumerate all running processes.

Final1stspy obtains a list of running processes.

MgBot includes a module for establishing a process watchdog for itself, identifying if the MgBot process is still running.

LockBit 2.0 can determine if a running process has administrative privileges and terminate processes that interfere with encryption or exfiltration.

Zebrocy uses the tasklist and wmic process get Capture, ExecutablePath commands to gather the processes running on the system.

Pandora can monitor processes on a compromised host.

FinFisher checks its parent process for indications that it is running in a sandbox setup.