Atomic Red Team doc generator
355 lines
9.2 KiB
Markdown
355 lines
9.2 KiB
Markdown
# T1057 - Process Discovery
|
|
## [Description from ATT&CK](https://attack.mitre.org/techniques/T1057)
|
|
<blockquote>
|
|
|
|
Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Administrator or otherwise elevated access may provide better process details. Adversaries may use the information from [Process Discovery](https://attack.mitre.org/techniques/T1057) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
|
|
|
|
In Windows environments, adversaries could obtain details on running processes using the [Tasklist](https://attack.mitre.org/software/S0057) utility via [cmd](https://attack.mitre.org/software/S0106) or <code>Get-Process</code> via [PowerShell](https://attack.mitre.org/techniques/T1059/001). Information about processes can also be extracted from the output of [Native API](https://attack.mitre.org/techniques/T1106) calls such as <code>CreateToolhelp32Snapshot</code>. In Mac and Linux, this is accomplished with the <code>ps</code> command. Adversaries may also opt to enumerate processes via `/proc`. ESXi also supports use of the `ps` command, as well as `esxcli system process list`.(Citation: Sygnia ESXi Ransomware 2025)(Citation: Crowdstrike Hypervisor Jackpotting Pt 2 2021)
|
|
|
|
On network devices, [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) commands such as `show processes` can be used to display current running processes.(Citation: US-CERT-TA18-106A)(Citation: show_processes_cisco_cmd)
|
|
|
|
</blockquote>
|
|
|
|
## Atomic Tests
|
|
|
|
- [Atomic Test #1 - Process Discovery - ps](#atomic-test-1---process-discovery---ps)
|
|
|
|
- [Atomic Test #2 - Process Discovery - tasklist](#atomic-test-2---process-discovery---tasklist)
|
|
|
|
- [Atomic Test #3 - Process Discovery - Get-Process](#atomic-test-3---process-discovery---get-process)
|
|
|
|
- [Atomic Test #4 - Process Discovery - get-wmiObject](#atomic-test-4---process-discovery---get-wmiobject)
|
|
|
|
- [Atomic Test #5 - Process Discovery - wmic process](#atomic-test-5---process-discovery---wmic-process)
|
|
|
|
- [Atomic Test #6 - Discover Specific Process - tasklist](#atomic-test-6---discover-specific-process---tasklist)
|
|
|
|
- [Atomic Test #7 - Process Discovery - Process Hacker](#atomic-test-7---process-discovery---process-hacker)
|
|
|
|
- [Atomic Test #8 - Process Discovery - PC Hunter](#atomic-test-8---process-discovery---pc-hunter)
|
|
|
|
- [Atomic Test #9 - Launch Taskmgr from cmd to View running processes](#atomic-test-9---launch-taskmgr-from-cmd-to-view-running-processes)
|
|
|
|
|
|
<br/>
|
|
|
|
## Atomic Test #1 - Process Discovery - ps
|
|
Utilize ps to identify processes.
|
|
|
|
Upon successful execution, sh will execute ps and output to /tmp/loot.txt.
|
|
|
|
**Supported Platforms:** Linux, macOS
|
|
|
|
|
|
**auto_generated_guid:** 4ff64f0b-aaf2-4866-b39d-38d9791407cc
|
|
|
|
|
|
|
|
|
|
|
|
#### Inputs:
|
|
| Name | Description | Type | Default Value |
|
|
|------|-------------|------|---------------|
|
|
| output_file | path of output file | path | /tmp/loot.txt|
|
|
|
|
|
|
#### Attack Commands: Run with `sh`!
|
|
|
|
|
|
```sh
|
|
ps >> #{output_file}
|
|
ps aux >> #{output_file}
|
|
```
|
|
|
|
#### Cleanup Commands:
|
|
```sh
|
|
rm #{output_file}
|
|
```
|
|
|
|
|
|
|
|
|
|
|
|
<br/>
|
|
<br/>
|
|
|
|
## Atomic Test #2 - Process Discovery - tasklist
|
|
Utilize tasklist to identify processes.
|
|
|
|
Upon successful execution, cmd.exe will execute tasklist.exe to list processes. Output will be via stdout.
|
|
|
|
**Supported Platforms:** Windows
|
|
|
|
|
|
**auto_generated_guid:** c5806a4f-62b8-4900-980b-c7ec004e9908
|
|
|
|
|
|
|
|
|
|
|
|
|
|
#### Attack Commands: Run with `command_prompt`!
|
|
|
|
|
|
```cmd
|
|
tasklist
|
|
```
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<br/>
|
|
<br/>
|
|
|
|
## Atomic Test #3 - Process Discovery - Get-Process
|
|
Utilize Get-Process PowerShell cmdlet to identify processes.
|
|
|
|
Upon successful execution, powershell.exe will execute Get-Process to list processes. Output will be via stdout.
|
|
|
|
**Supported Platforms:** Windows
|
|
|
|
|
|
**auto_generated_guid:** 3b3809b6-a54b-4f5b-8aff-cb51f2e97b34
|
|
|
|
|
|
|
|
|
|
|
|
|
|
#### Attack Commands: Run with `powershell`!
|
|
|
|
|
|
```powershell
|
|
Get-Process
|
|
```
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<br/>
|
|
<br/>
|
|
|
|
## Atomic Test #4 - Process Discovery - get-wmiObject
|
|
Utilize get-wmiObject PowerShell cmdlet to identify processes.
|
|
|
|
Upon successful execution, powershell.exe will execute get-wmiObject to list processes. Output will be via stdout.
|
|
|
|
**Supported Platforms:** Windows
|
|
|
|
|
|
**auto_generated_guid:** b51239b4-0129-474f-a2b4-70f855b9f2c2
|
|
|
|
|
|
|
|
|
|
|
|
|
|
#### Attack Commands: Run with `powershell`!
|
|
|
|
|
|
```powershell
|
|
get-wmiObject -class Win32_Process
|
|
```
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<br/>
|
|
<br/>
|
|
|
|
## Atomic Test #5 - Process Discovery - wmic process
|
|
Utilize windows management instrumentation to identify processes.
|
|
|
|
Upon successful execution, WMIC will execute process to list processes. Output will be via stdout.
|
|
|
|
**Supported Platforms:** Windows
|
|
|
|
|
|
**auto_generated_guid:** 640cbf6d-659b-498b-ba53-f6dd1a1cc02c
|
|
|
|
|
|
|
|
|
|
|
|
|
|
#### Attack Commands: Run with `command_prompt`!
|
|
|
|
|
|
```cmd
|
|
wmic process get /format:list
|
|
```
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<br/>
|
|
<br/>
|
|
|
|
## Atomic Test #6 - Discover Specific Process - tasklist
|
|
Adversaries may use command line tools to discover specific processes in preparation of further attacks.
|
|
Examples of this could be discovering the PID of lsass.exe to dump its memory or discovering whether specific security processes (e.g. AV or EDR) are running.
|
|
|
|
**Supported Platforms:** Windows
|
|
|
|
|
|
**auto_generated_guid:** 11ba69ee-902e-4a0f-b3b6-418aed7d7ddb
|
|
|
|
|
|
|
|
|
|
|
|
#### Inputs:
|
|
| Name | Description | Type | Default Value |
|
|
|------|-------------|------|---------------|
|
|
| process_to_enumerate | Process name string to search for. | string | lsass|
|
|
|
|
|
|
#### Attack Commands: Run with `command_prompt`!
|
|
|
|
|
|
```cmd
|
|
tasklist | findstr #{process_to_enumerate}
|
|
```
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<br/>
|
|
<br/>
|
|
|
|
## Atomic Test #7 - Process Discovery - Process Hacker
|
|
Process Hacker can be exploited to infiltrate system processes, identify weak points, or achieve unauthorized control over systems. However, its malicious use can often be flagged by security defenses, rendering it a perilous tool for illegitimate purposes.
|
|
|
|
**Supported Platforms:** Windows
|
|
|
|
|
|
**auto_generated_guid:** 966f4c16-1925-4d9b-8ce0-01334ee0867d
|
|
|
|
|
|
|
|
|
|
|
|
#### Inputs:
|
|
| Name | Description | Type | Default Value |
|
|
|------|-------------|------|---------------|
|
|
| processhacker_exe | Process hacker installation executables. | string | ProcessHacker.exe|
|
|
|
|
|
|
#### Attack Commands: Run with `powershell`! Elevation Required (e.g. root or admin)
|
|
|
|
|
|
```powershell
|
|
Start-Process -FilePath "$Env:ProgramFiles\Process Hacker 2\#{processhacker_exe}"
|
|
```
|
|
|
|
|
|
|
|
|
|
#### Dependencies: Run with `powershell`!
|
|
##### Description: Process Hacker must be installed in the location
|
|
##### Check Prereq Commands:
|
|
```powershell
|
|
if (Test-Path "c:\Program Files\Process Hacker 2\#{processhacker_exe}") {exit 0} else {exit 1}
|
|
```
|
|
##### Get Prereq Commands:
|
|
```powershell
|
|
Write-Host Downloading Process Hacker
|
|
New-Item -Type Directory "C:\Temp\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
|
|
Invoke-WebRequest "https://versaweb.dl.sourceforge.net/project/processhacker/processhacker2/processhacker-2.39-setup.exe" -OutFile "C:\Temp\ExternalPayloads\processhacker-2.39-setup.exe"
|
|
Write-Host Installing Process Hacker
|
|
Start-Process "c:\Temp\ExternalPayloads\processhacker-2.39-setup.exe" -Wait -ArgumentList "/s"
|
|
```
|
|
|
|
|
|
|
|
|
|
<br/>
|
|
<br/>
|
|
|
|
## Atomic Test #8 - Process Discovery - PC Hunter
|
|
PC Hunter is a toolkit with access to hundreds of settings including kernels, kernel modules, processes, network, startup, and more. When abused, this tool can allow threat actors to effectively access sensitive processes, collect system information, and terminate security software.
|
|
|
|
**Supported Platforms:** Windows
|
|
|
|
|
|
**auto_generated_guid:** b4ca838d-d013-4461-bf2c-f7132617b409
|
|
|
|
|
|
|
|
|
|
|
|
#### Inputs:
|
|
| Name | Description | Type | Default Value |
|
|
|------|-------------|------|---------------|
|
|
| pchunter64_exe | Process hacker installation executables. | string | PChunter64.exe|
|
|
|
|
|
|
#### Attack Commands: Run with `powershell`! Elevation Required (e.g. root or admin)
|
|
|
|
|
|
```powershell
|
|
Start-Process -FilePath "C:\Temp\ExternalPayloads\PCHunter_free\#{pchunter64_exe}"
|
|
```
|
|
|
|
|
|
|
|
|
|
#### Dependencies: Run with `powershell`!
|
|
##### Description: PCHunter must be present in device
|
|
##### Check Prereq Commands:
|
|
```powershell
|
|
if (Get-ChildItem -Path C:\ -Include *PCHunter64* -File -Recurse -ErrorAction SilentlyContinue) {exit 0} else {exit 1}
|
|
```
|
|
##### Get Prereq Commands:
|
|
```powershell
|
|
Write-Host Downloading PC Hunter
|
|
New-Item -Type Directory "C:\Temp\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
|
|
Invoke-WebRequest "https://www.snapfiles.com/directdl/PCHunter_free.zip" -OutFile "C:\Temp\ExternalPayloads\PCHunter_free.zip"
|
|
Expand-Archive -LiteralPath 'C:\Temp\ExternalPayloads\PCHunter_free.zip' -DestinationPath C:\Temp\ExternalPayloads
|
|
Write-Host Unzipping Installing Process Hunter
|
|
```
|
|
|
|
|
|
|
|
|
|
<br/>
|
|
<br/>
|
|
|
|
## Atomic Test #9 - Launch Taskmgr from cmd to View running processes
|
|
An adverary may launch taskmgr.exe with the /7 switch via command prompt to view processes running on the system.
|
|
[Reference](https://github.com/trellix-enterprise/ac3-threat-sightings/blob/main/sightings/Sightings_Conti_Ransomware.yml)
|
|
|
|
**Supported Platforms:** Windows
|
|
|
|
|
|
**auto_generated_guid:** 4fd35378-39aa-481e-b7c4-e3bf49375c67
|
|
|
|
|
|
|
|
|
|
|
|
|
|
#### Attack Commands: Run with `command_prompt`!
|
|
|
|
|
|
```cmd
|
|
taskmgr.exe /7
|
|
```
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<br/>
|