# T1057 - Process Discovery
## [Description from ATT&CK](https://attack.mitre.org/techniques/T1057)
<blockquote>Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from [Process Discovery](https://attack.mitre.org/techniques/T1057) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.

In Windows environments, adversaries could obtain details on running processes using the [Tasklist](https://attack.mitre.org/software/S0057) utility via [cmd](https://attack.mitre.org/software/S0106) or <code>Get-Process</code> via [PowerShell](https://attack.mitre.org/techniques/T1059/001). Information about processes can also be extracted from the output of [Native API](https://attack.mitre.org/techniques/T1106) calls such as <code>CreateToolhelp32Snapshot</code>. In Mac and Linux, this is accomplished with the <code>ps</code> command. Adversaries may also opt to enumerate processes via /proc.</blockquote>

## Atomic Tests

- [Atomic Test #1 - Process Discovery - ps](#atomic-test-1---process-discovery---ps)

- [Atomic Test #2 - Process Discovery - tasklist](#atomic-test-2---process-discovery---tasklist)


<br/>

## Atomic Test #1 - Process Discovery - ps
Utilize ps to identify processes.

Upon successful execution, sh will execute ps and output to /tmp/loot.txt.

**Supported Platforms:** macOS, Linux


**auto_generated_guid:** 4ff64f0b-aaf2-4866-b39d-38d9791407cc





#### Inputs:
| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| output_file | path of output file | path | /tmp/loot.txt|


#### Attack Commands: Run with `sh`! 


```sh
ps >> #{output_file}
ps aux >> #{output_file}
```

#### Cleanup Commands:
```sh
rm #{output_file}
```





<br/>
<br/>

## Atomic Test #2 - Process Discovery - tasklist
Utilize tasklist to identify processes.

Upon successful execution, cmd.exe will execute tasklist.exe to list processes. Output will be via stdout.

**Supported Platforms:** Windows


**auto_generated_guid:** c5806a4f-62b8-4900-980b-c7ec004e9908






#### Attack Commands: Run with `command_prompt`! 


```cmd
tasklist
```






<br/>
