Cross-source coverage

T1057 / ATT&CK

Process Discovery

38 rules · 35 families across 7 sources.

4 deprecated hidden · include

From MITRE ATT&CK 19.2

Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Administrator or otherwise elevated access may provide better process details. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.

In Windows environments, adversaries could obtain details on running processes using the Tasklist utility via cmd or Get-Process via PowerShell. Information about processes can also be extracted from the output of Native API calls such as CreateToolhelp32Snapshot. In Mac and Linux, this is accomplished with the ps command. Adversaries may also opt to enumerate processes via /proc. ESXi also supports use of the ps command, as well as esxcli system process list.

On network devices, Network Device CLI commands such as show processes can be used to display current running processes.

Tactics: Discovery
Platforms: ESXi · Linux · macOS · Network Devices · Windows
Telemetry: WinEventLog:SecurityWinEventLog:Sysmonauditd:SYSCALLlinux:osquerymacos:unifiedlogmacos:osqueryesxi:shellesxi:authnetworkdevice:clinetworkdevice:syslog

How MITRE says to detect it DET0034

Detection of Adversarial Process Discovery Behavior

Windows Analytic 0095

Identifies adversary behavior that launches commands or invokes APIs to enumerate active processes (e.g., tasklist.exe, Get-Process, or CreateToolhelp32Snapshot). Detects execution combined with parent process lineage, network session context, or remote origin.

WinEventLog:Security EventCode=4688
WinEventLog:Sysmon EventCode=10

Linux Analytic 0096

Detects execution of common process enumeration utilities (e.g., ps, top, htop) or access to /proc with suspicious ancestry. Correlates command usage with interactive shell context and user role.

auditd:SYSCALL execve
auditd:SYSCALL openat
linux:osquery Process State

macOS Analytic 0097

Monitors execution of ps, top, or launchctl with unusual parent processes or from terminal scripts. Also detects AppleScript-based process listing or `system_profiler SPApplicationsDataType` misuse.

macos:unifiedlog process launch
macos:osquery Process Context

ESXi Analytic 0098

Detects process enumeration using `esxcli system process list` or `ps` on ESXi shell or via unauthorized SSH sessions. Correlates with interactive sessions and abnormal user roles.

esxi:shell interactive shell
esxi:auth user session

Network Devices Analytic 0099

Monitors CLI-based execution of `show process` or equivalent on routers/switches. Correlates unusual device access, unauthorized roles, or config mode changes.

networkdevice:cli CLI command
networkdevice:syslog Admin activity

View on attack.mitre.org ↗

elastic/detection-rules

12 rules

Detection	Severity	Format
Potential Linux Credential Dumping via Proc Filesystem	High	Elastic TOML
Suspicious Dynamic Linker Discovery via od	High	Elastic TOML
Suspicious Memory grep Activity	High	Elastic TOML
Suspicious /proc/maps Discovery	High	Elastic TOML
Potential Linux Hack Tool Launched	Medium	Elastic TOML
Process Capability Enumeration	Medium	Elastic TOML
Suspicious JetBrains TeamCity Child Process	Medium	Elastic TOML
Suspicious MS Office Child Process	Medium	Elastic TOML
Enumeration Command Spawned via WMIPrvSE	Low	Elastic TOML
Suspicious PDF Reader Child Process	Low	Elastic TOML

+ 2 more from elastic/detection-rules → showing the 10 highest-severity

SigmaHQ/sigma

8 rules

Detection	Severity	Format
HackTool - PCHunter Execution	High	Sigma
Potential Process Reconnaissance via Wmic.EXE	Medium	Sigma
Recon Command Output Piped To Findstr.EXE	Medium	Sigma
Cisco Discovery	Low	Sigma
Process Discovery	Low	Sigma
Suspicious Process Discovery With Get-Process	Low	Sigma
System Info Discovery via Sysinfo Syscall	Low	Sigma
Suspicious Tasklist Discovery Command	Informational	Sigma

socfortress/Wazuh-Rules

7 rules · 6 families

Detection	Severity	Format
Process Discovery attempt: 'ps' command executed	Medium	Wazuh XML
Sysmon - Event 12: RegistryEvent (Object create and delete) by · Process Discovery (T1057)	Low	Wazuh XML
Sysmon - Event 13: RegistryEvent (Value Set) by · Process Discovery (T1057)	Low	Wazuh XML
Sysmon - Event 14: RegistryEvent (Key and Value Rename) by · Process Discovery (T1057)	Low	Wazuh XML
Sysmon - Event 1: Process creation · Process Discovery (T1057) 2 variants	Low	Wazuh XML
Sysmon - Event 1: Process creation · Process Discovery (T1057) 2 variants	Low	Wazuh XML
Sysmon - Event 3: Network connection by · Process Discovery (T1057)	Low	Wazuh XML

Emerging Threats Open

4 rules · 2 families

Detection	Severity	Format
ET MALWARE Outbound POST Request with Base64 ps PowerShell Command Output M1 3 variants	High	Suricata
ET MALWARE Outbound POST Request with Base64 ps PowerShell Command Output M2 3 variants	High	Suricata
ET MALWARE Outbound POST Request with Base64 ps PowerShell Command Output M3 3 variants	High	Suricata
ET MALWARE Outbound POST Request with ps PowerShell Command Output	High	Suricata

Wazuh Core Ruleset

4 rules

Detection	Severity	Format
Processes running for all users were queried with ps command.	Medium	Wazuh XML
Powershell executed "CreateToolhelp32Snapshot". Possible process discovery	Low	Wazuh XML
Powershell executing process discovery	Low	Wazuh XML
Powershell queried Win32_Process. Possible process discovery activity	Low	Wazuh XML

elastic/protections-artifacts

2 rules

Detection	Severity	Format
Discovery of GitHub Actions Runner Process PID	Undefined	Elastic TOML
Suspicious Reading of procfs Maps File	Undefined	Elastic TOML

splunk/security_content

1 rule

Detection	Severity	Format
Windows Process Commandline Discovery	Undefined	SPL