Procedure examples

LunarWeb has used shell commands to list running processes.

KillDisk has called GetCurrentProcess.

Qilin can define specific processes to be terminated or left alone at execution.

SoreFang can enumerate processes on a victim machine through use of Tasklist.

Socksbot can list all running processes.

Agent Tesla can list the current running processes on the system.

Pasam creates a backdoor through which remote attackers can retrieve lists of running processes.

POWERSTATS has used get_tasklist to discover processes on the compromised host.

Linfo creates a backdoor through which remote attackers can retrieve a list of running processes.

Goopy has checked for the Google Updater process to ensure Goopy was loaded properly.

ShadowPad has collected the PID of a malicious process.

Astaroth searches for different processes on the system.

QakBot has the ability to check running processes.

SYSCON has the ability to use Tasklist to list running processes.

Gelsemium can enumerate running processes.

jRAT can query and kill system processes.

Helminth has used Tasklist to get information on processes.

The OsInfo function in Komplex collects a running process list.

INC Ransomware can use the Microsoft Win32 Restart Manager to kill processes with a specific handle or that are accessing resources it wants to encrypt.

Waterbear can identify the process for a specific security product.

Comnie uses the tasklist to view running processes on the victim’s machine.

Lizar has a plugin designed to obtain a list of processes.

Dtrack’s dropper can list all running processes.

LoudMiner used the ps command to monitor the running processes on the system.

Azorult can collect a list of running processes by calling CreateToolhelp32Snapshot.

BACKSPACE may collect information about running processes.

Zox has the ability to list processes.

ADVSTORESHELL can list running processes.

WarzoneRAT can obtain a list of processes on a compromised host.

SLOTHFULMEDIA has enumerated processes by ID, name, or privileges.

ShimRatReporter listed all running processes on the machine.

SILENTTRINITY can enumerate processes, including properties to determine if they have the Common Language Runtime (CLR) loaded.

PowerSploit's Get-ProcessTokenPrivilege Privesc-PowerUp module can enumerate privileges for a given process.

Tasklist can be used to discover processes running on a system.

Empire can find information about processes running on local and remote systems.

PcShare can obtain a list of running processes on a compromised host.

AsyncRAT can examine running processes to determine if a debugger is present.

Brute Ratel C4 can enumerate all processes and locate specific process IDs (PIDs).

Remcos can discover running processes on compromised machines.

Imminent Monitor has a "Process Watcher" feature to monitor processes in case the client ever crashes or gets closed.

Donut includes subprojects that enumerate and identify information about Process Injection candidates.

IronNetInjector can identify processes via C# methods such as GetProcessesByName and running Tasklist with the Python os.popen function.

Pupy can list the running processes and get the process ID and parent process’s ID.

TeamPCP Cloud Stealer can locate GitHub Actions runner processes.

The discovery modules used with Duqu can collect information on process details.

For Operation Spalax, the threat actors used Nullsoft Scriptable Install System (NSIS) scripts to install malware.

During Cutting Edge, threat actors used Perl scripts to enable the deployment of the THINSPOOL shell script dropper and for enumerating host data.

ArcaneDoor included the adversary executing command line interface (CLI) commands.

FLORAHOX Activity has executed PHP and Shell scripts to identify and infect subsequent routers for the ORB network.

Dragonfly has used the command line for execution.