Procedure examples

Cobalt Strike's Beacon payload can collect information on process details.

SUNBURST collected a list of process names that were hashed using a FNV-1a + XOR algorithm to check against similarly-hashed hardcoded blocklists.

EvilBunny has used EnumProcesses() to identify how many process are running in the environment.

HotCroissant has the ability to list running processes on the infected host.

Valak has the ability to enumerate running processes on a compromised host.

Taidoor can use GetCurrentProcessId for process discovery.

CaddyWiper can obtain a list of current processes.

Cyclops Blink can enumerate the process it is currently running under.

Seasalt has a command to perform a process listing.

TajMahal has the ability to identify running processes and associated plugins on an infected host.

PLEAD has the ability to list processes on the compromised host.

IPsec Helper can identify the process it is currently running under and its number, and pass this back to a command and control node.

Carbon can list the processes on the victim’s machine.

TRAILBLAZE has conducted process discovery by searching for specific named processes such as `/home/bin/web`.

Cardinal RAT contains watchdog functionality that ensures its process is always running, else spawns a new instance.

BISCUIT has a command to enumerate running processes and identify their owners.

Gold Dragon checks the running processes on the victim’s machine.

Ramsay can gather a list of running processes by using Tasklist.

The AshTag AshenOrchestrator component has process management functionality.

Carberp has collected a list of running processes.

NKAbuse will check victim systems to ensure only one copy of the malware is running.

Pillowmint can iterate through running processes every six seconds collecting a list of processes to capture from later.

MacMa can enumerate running processes.

FunnyDream has the ability to discover processes, including `Bka.exe` and `BkavUtil.exe`.

SUNSPOT monitored running processes for instances of MsBuild.exe by hashing the name of each running process and comparing it to the corresponding value 0x53D525. It also extracted command-line arguments and individual arguments from the running MsBuild.exe process to identify the directory path of the Orion software Visual Studio solution.

SysUpdate can collect information about running processes.

OutSteel can identify running processes on a compromised host.

Kwampirs collects a list of running services with the command tasklist /v.

LAMEHUG can gather process information on targeted systems.

LookBack can list running processes.

Clop can enumerate all processes on the victim's machine.

PoetRAT has the ability to list all running processes.

FELIXROOT collects a list of running processes.

ZxShell has a command, ps, to obtain a listing of processes on the system.

SPAWNCHIMERA has searched for running processes to include web or dsmdm.

BabyShark has executed the tasklist command.

Cannon can obtain a list of processes running on the system.

Winnti for Windows can check if the explorer.exe process is responsible for calling its install function.

BLACKCOFFEE has the capability to discover processes.

Kinsing has used ps to list processes.

Meteor can check if a specific process is running, such as Kaspersky's `avp.exe`.

njRAT can search a list of running processes for Tr.exe.

ZIPLINE can identify running processes and their names.

Maze has gathered all of the running system processes.

HIUPAN has conducted process discovery to identify the PUBLOAD malware under the process WCBrowserWatcher.exe and will launch it from an install directory if it is not found.

ChChes collects its process identifier (PID) on the victim.

PowerStallion has been used to monitor process lists.

JPIN can list running processes.

metaMain can enumerate the processes that run on the platform.

Heyoka Backdoor can gather process information.