Techniques › T1057
T1057 Process Discovery
discovery — ESXi, Linux, macOS, Network Devices, Windows · attack.mitre.org · JSON
1
MITRE detection strategy
5
analytics
8
Sigma rules tagged attack.t1057
0
KEV CVEs mapped here
<p>Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Administrator or otherwise elevated access may provide better process details. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.</p><p>In Windows environments, adversaries could obtain details on running processes using the Tasklist utility via cmd or <code>Get-Process</code> via PowerShell. Information about processes can also be extracted from the output of Native API calls such as <code>CreateToolhelp32Snapshot</code>. In Mac and Linux, this is accomplished with the <code>ps</code> command. Adversaries may also opt to enumerate processes via
/proc. ESXi also supports use of the ps command, as well as esxcli system process list.</p><p>On network devices, Network Device CLI commands such as show processes can be used to display current running processes.</p>KEV CVEs mapped to this technique · CTID Mappings Explorer
None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.
Detection strategy · ATT&CK Enterprise v19.2
- DET0034 Detection of Adversarial Process Discovery Behavior v1.0
AN0095 WindowsIdentifies adversary behavior that launches commands or invokes APIs to enumerate active processes (e.g., tasklist.exe, Get-Process, or CreateToolhelp32Snapshot). Detects execution combined with parent process lineage, network session context, or remote origin.Tunable:
ParentProcessNameCommandLinePatternTimeWindowAN0096 LinuxDetects execution of common process enumeration utilities (e.g., ps, top, htop) or access to /proc with suspicious ancestry. Correlates command usage with interactive shell context and user role.Tunable:AccessedPathUserContextAN0097 macOSMonitors execution of ps, top, or launchctl with unusual parent processes or from terminal scripts. Also detects AppleScript-based process listing orsystem_profiler SPApplicationsDataTypemisuse.Tunable:ParentAppAN0098 ESXiDetects process enumeration usingesxcli system process listorpson ESXi shell or via unauthorized SSH sessions. Correlates with interactive sessions and abnormal user roles.Tunable:UserAN0099 Network DevicesMonitors CLI-based execution ofshow processor equivalent on routers/switches. Correlates unusual device access, unauthorized roles, or config mode changes.Tunable:UsernameCommandString
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1057
Author: frack113
· 2022-01-01 (modified 2025-12-15) · logsource: product=windows category=process_creation · 221b251a-357a-49a9-920a-271802777cc0
Detects the execution of "wmic" with the "process" flag, which might indicate an attempt to perform reconnaissance on running processes.
Adversaries may use wmic to query for running processes and their details as part of their reconnaissance efforts.
Author: Ömer Günal, oscd.community, CheraaghiMilad
· 2020-10-06 (modified 2022-07-07) · logsource: product=linux category=process_creation · 4e2f5868-08d4-413d-899f-dc2f1508627b
Detects process discovery commands. Adversaries may attempt to get information about running processes on a system.
Information obtained could be used to gain an understanding of common software/applications running on systems within the network
Author: frack113
· 2021-12-11 (modified 2022-12-25) · logsource: product=windows category=process_creation · 63332011-f057-496c-ad8d-d2b6afb27f96
Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network
Author: Austin Clark
· 2019-08-12 (modified 2023-01-04) · logsource: product=cisco service=aaa · 9705a6a1-6db6-4a16-a987-15b7151e299b
Find information about network devices that is not stored in config files
Author: frack113
· 2022-03-17 · logsource: product=windows category=ps_script · af4c87ce-bdda-4215-b998-15220772e993
Get the processes that are running on the local computer.
Author: Milad Cheraghi
· 2025-05-30 (modified 2025-12-05) · logsource: product=linux service=auditd · b207d563-a1d9-4275-b349-77d1eb55aa6d
Detects use of the sysinfo system call in Linux, which provides a snapshot of key system statistics such as uptime, load averages, memory usage, and the number of running processes.
Malware or reconnaissance tools might leverage sysinfo to fingerprint the system - gathering data to determine if it's a viable target.
Author: Nasreddine Bencherchali (Nextron Systems), frack113
· 2023-07-06 (modified 2025-10-08) · logsource: product=windows category=process_creation · ccb5742c-c248-4982-8c5c-5571b9275ad3
Detects the execution of a potential recon command where the results are piped to "findstr". This is meant to trigger on inline calls of "cmd.exe" via the "/c" or "/k" for example.
Attackers often time use this technique to extract specific information they require in their reconnaissance phase.
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali
· 2022-10-10 (modified 2024-11-23) · logsource: product=windows category=process_creation · fca949cc-79ca-446e-8064-01aa7e52ece5
Detects suspicious use of PCHunter, a tool like Process Hacker to view and manipulate processes, kernel options and other low level stuff