# T1057 - Process Discovery
## [Description from ATT&CK](https://attack.mitre.org/techniques/T1057)
<blockquote>

Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Administrator or otherwise elevated access may provide better process details. Adversaries may use the information from [Process Discovery](https://attack.mitre.org/techniques/T1057) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.

In Windows environments, adversaries could obtain details on running processes using the [Tasklist](https://attack.mitre.org/software/S0057) utility via [cmd](https://attack.mitre.org/software/S0106) or <code>Get-Process</code> via [PowerShell](https://attack.mitre.org/techniques/T1059/001). Information about processes can also be extracted from the output of [Native API](https://attack.mitre.org/techniques/T1106) calls such as <code>CreateToolhelp32Snapshot</code>. In Mac and Linux, this is accomplished with the <code>ps</code> command. Adversaries may also opt to enumerate processes via `/proc`. ESXi also supports use of the `ps` command, as well as `esxcli system process list`.(Citation: Sygnia ESXi Ransomware 2025)(Citation: Crowdstrike Hypervisor Jackpotting Pt 2 2021)

On network devices, [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) commands such as `show processes` can be used to display current running processes.(Citation: US-CERT-TA18-106A)(Citation: show_processes_cisco_cmd)

</blockquote>

## Atomic Tests

- [Atomic Test #1 - Process Discovery - ps](#atomic-test-1---process-discovery---ps)

- [Atomic Test #2 - Process Discovery - tasklist](#atomic-test-2---process-discovery---tasklist)

- [Atomic Test #3 - Process Discovery - Get-Process](#atomic-test-3---process-discovery---get-process)

- [Atomic Test #4 - Process Discovery - get-wmiObject](#atomic-test-4---process-discovery---get-wmiobject)

- [Atomic Test #5 - Process Discovery - wmic process](#atomic-test-5---process-discovery---wmic-process)

- [Atomic Test #6 - Discover Specific Process - tasklist](#atomic-test-6---discover-specific-process---tasklist)

- [Atomic Test #7 - Process Discovery - Process Hacker](#atomic-test-7---process-discovery---process-hacker)

- [Atomic Test #8 - Process Discovery - PC Hunter](#atomic-test-8---process-discovery---pc-hunter)

- [Atomic Test #9 - Launch Taskmgr from cmd to View running processes](#atomic-test-9---launch-taskmgr-from-cmd-to-view-running-processes)


<br/>

## Atomic Test #1 - Process Discovery - ps
Utilize ps to identify processes.

Upon successful execution, sh will execute ps and output to /tmp/loot.txt.

**Supported Platforms:** Linux, macOS


**auto_generated_guid:** 4ff64f0b-aaf2-4866-b39d-38d9791407cc





#### Inputs:
| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| output_file | path of output file | path | /tmp/loot.txt|


#### Attack Commands: Run with `sh`! 


```sh
ps >> #{output_file}
ps aux >> #{output_file}
```

#### Cleanup Commands:
```sh
rm #{output_file}
```





<br/>
<br/>

## Atomic Test #2 - Process Discovery - tasklist
Utilize tasklist to identify processes.

Upon successful execution, cmd.exe will execute tasklist.exe to list processes. Output will be via stdout.

**Supported Platforms:** Windows


**auto_generated_guid:** c5806a4f-62b8-4900-980b-c7ec004e9908






#### Attack Commands: Run with `command_prompt`! 


```cmd
tasklist
```






<br/>
<br/>

## Atomic Test #3 - Process Discovery - Get-Process
Utilize Get-Process PowerShell cmdlet to identify processes.

Upon successful execution, powershell.exe will execute Get-Process to list processes. Output will be via stdout.

**Supported Platforms:** Windows


**auto_generated_guid:** 3b3809b6-a54b-4f5b-8aff-cb51f2e97b34






#### Attack Commands: Run with `powershell`! 


```powershell
Get-Process
```






<br/>
<br/>

## Atomic Test #4 - Process Discovery - get-wmiObject
Utilize get-wmiObject PowerShell cmdlet to identify processes.

Upon successful execution, powershell.exe will execute get-wmiObject to list processes. Output will be via stdout.

**Supported Platforms:** Windows


**auto_generated_guid:** b51239b4-0129-474f-a2b4-70f855b9f2c2






#### Attack Commands: Run with `powershell`! 


```powershell
get-wmiObject -class Win32_Process
```






<br/>
<br/>

## Atomic Test #5 - Process Discovery - wmic process
Utilize windows management instrumentation to identify processes.

Upon successful execution, WMIC will execute process to list processes. Output will be via stdout.

**Supported Platforms:** Windows


**auto_generated_guid:** 640cbf6d-659b-498b-ba53-f6dd1a1cc02c






#### Attack Commands: Run with `command_prompt`! 


```cmd
wmic process get /format:list
```






<br/>
<br/>

## Atomic Test #6 - Discover Specific Process - tasklist
Adversaries may use command line tools to discover specific processes in preparation of further attacks. 
Examples of this could be discovering the PID of lsass.exe to dump its memory or discovering whether specific security processes (e.g. AV or EDR) are running.

**Supported Platforms:** Windows


**auto_generated_guid:** 11ba69ee-902e-4a0f-b3b6-418aed7d7ddb





#### Inputs:
| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| process_to_enumerate | Process name string to search for. | string | lsass|


#### Attack Commands: Run with `command_prompt`! 


```cmd
tasklist | findstr #{process_to_enumerate}
```






<br/>
<br/>

## Atomic Test #7 - Process Discovery - Process Hacker
Process Hacker can be exploited to infiltrate system processes, identify weak points, or achieve unauthorized control over systems. However, its malicious use can often be flagged by security defenses, rendering it a perilous tool for illegitimate purposes.

**Supported Platforms:** Windows


**auto_generated_guid:** 966f4c16-1925-4d9b-8ce0-01334ee0867d





#### Inputs:
| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| processhacker_exe | Process hacker installation executables. | string | ProcessHacker.exe|


#### Attack Commands: Run with `powershell`!  Elevation Required (e.g. root or admin) 


```powershell
Start-Process -FilePath "$Env:ProgramFiles\Process Hacker 2\#{processhacker_exe}"
```




#### Dependencies:  Run with `powershell`!
##### Description: Process Hacker must be installed in the location
##### Check Prereq Commands:
```powershell
if (Test-Path "c:\Program Files\Process Hacker 2\#{processhacker_exe}") {exit 0} else {exit 1}
```
##### Get Prereq Commands:
```powershell
Write-Host Downloading Process Hacker
New-Item -Type Directory "C:\Temp\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
Invoke-WebRequest "https://versaweb.dl.sourceforge.net/project/processhacker/processhacker2/processhacker-2.39-setup.exe" -OutFile "C:\Temp\ExternalPayloads\processhacker-2.39-setup.exe"
Write-Host Installing Process Hacker
Start-Process "c:\Temp\ExternalPayloads\processhacker-2.39-setup.exe" -Wait -ArgumentList "/s"
```




<br/>
<br/>

## Atomic Test #8 - Process Discovery - PC Hunter
PC Hunter is a toolkit with access to hundreds of settings including kernels, kernel modules, processes, network, startup, and more. When abused, this tool can allow threat actors to effectively access sensitive processes, collect system information, and terminate security software.

**Supported Platforms:** Windows


**auto_generated_guid:** b4ca838d-d013-4461-bf2c-f7132617b409





#### Inputs:
| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| pchunter64_exe | Process hacker installation executables. | string | PChunter64.exe|


#### Attack Commands: Run with `powershell`!  Elevation Required (e.g. root or admin) 


```powershell
Start-Process -FilePath "C:\Temp\ExternalPayloads\PCHunter_free\#{pchunter64_exe}"
```




#### Dependencies:  Run with `powershell`!
##### Description: PCHunter must be present in device
##### Check Prereq Commands:
```powershell
if (Get-ChildItem -Path C:\ -Include *PCHunter64* -File -Recurse -ErrorAction SilentlyContinue) {exit 0} else {exit 1}
```
##### Get Prereq Commands:
```powershell
Write-Host Downloading PC Hunter
New-Item -Type Directory "C:\Temp\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
Invoke-WebRequest "https://www.snapfiles.com/directdl/PCHunter_free.zip" -OutFile "C:\Temp\ExternalPayloads\PCHunter_free.zip"
Expand-Archive -LiteralPath 'C:\Temp\ExternalPayloads\PCHunter_free.zip' -DestinationPath C:\Temp\ExternalPayloads
Write-Host Unzipping Installing Process Hunter
```




<br/>
<br/>

## Atomic Test #9 - Launch Taskmgr from cmd to View running processes
An adverary may launch taskmgr.exe with the /7 switch via command prompt to view processes running on the system.
[Reference](https://github.com/trellix-enterprise/ac3-threat-sightings/blob/main/sightings/Sightings_Conti_Ransomware.yml)

**Supported Platforms:** Windows


**auto_generated_guid:** 4fd35378-39aa-481e-b7c4-e3bf49375c67






#### Attack Commands: Run with `command_prompt`! 


```cmd
taskmgr.exe /7
```






<br/>