T1057 Process Discovery

Technique

T1057

Tactics

Discovery

Research, 90 days

6

KEV CVEs mapped

0

SigmaHQ rules

8

Elastic, Splunk

21

thrunt rules

0

Upstream

https://attack.mitre.org/techniques/T1057

MITRE description

Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Administrator or otherwise elevated access may provide better process details. Adversaries may use the information from [Process Discovery](https://attack.mitre.org/techniques/T1057) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. In Windows environments, adversaries could obtain details on running processes using the [Tasklist](https://attack.mitre.org/software/S0057) utility via [cmd](https://attack.mitre.org/software/S0106) or <code>Get-Process</code> via [PowerShell](https://attack.mitre.org/techniques/T1059/001). Information about processes can also be extracted from the output of [Native API](https://attack.mitre.org/techniques/T1106) calls such as <code>CreateToolhelp32Snapshot</code>. In Mac and Linux, this is accomplished with the <code>ps</code> command. Adversaries may also opt to enumerate processes via `/proc`. ESXi also supports use of the `ps` command, as well as `esxcli system process list`.(Citation: Sygnia ESXi Ransomware 2025)(Citation: Crowdstrike Hypervisor Jackpotting Pt 2 2021) On network devices, [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) commands such as `show processes` can be used to display current running processes.(Citation: US-CERT-TA18-106A)(Citation: show_processes_cisco_cmd)

Research citing this technique

Reports and advisories from the last 90 days that cite this technique.

• 2026-10-30 Microsoft Threat Intelligence: From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion paths
• 2026-10-30 Darktrace: CikaBika Bot: Inside a Discord RAT Campaign
• 2026-10-22 Group-IB: Inside SiriusQT: A Seriously Skilled RAT
• 2026-10-14 Group-IB: KGB RAT: A Fully Undetectable Windows Trojan Built to Spy, Steal, and Terrorize
• 2026-10-08 Huntress: Threat Actors Exploit Critical AhsayCBS Flaws to Drop Webshells and XMRig Cryptominer
• 2026-10-08 Zscaler ThreatLabz: Suspected TraderTraitor Group Uses Trojanized Terraform Provider to Deliver Cross-Platform Malware

Detection coverage

SigmaHQ community rules

• Process Discovery (threat-hunting)
• Suspicious Tasklist Discovery Command (threat-hunting)
• System Info Discovery via Sysinfo Syscall (core)
• Cisco Discovery (core)
• Suspicious Process Discovery With Get-Process (core)
• Recon Command Output Piped To Findstr.EXE (core)
• HackTool - PCHunter Execution (core)
• Potential Process Reconnaissance via Wmic.EXE (core)

Elastic and Splunk rules

• ESXi Virtual Machine Process List (elastic)
• Potential Linux Credential Dumping via Proc Filesystem (elastic)
• Suspicious Dynamic Linker Discovery via od (elastic)
• Suspicious /proc/maps Discovery (elastic)
• Process Capability Enumeration (elastic)
• Suspicious Memory grep Activity (elastic)
• Suspicious Reading of procfs Syscall File (elastic)
• Potential Linux Hack Tool Launched (elastic)
• Suspicious System Commands Executed by Previously Unknown Executable (elastic)
• Unusual Linux Process Discovery Activity (elastic)
• Enumeration Command Spawned via WMIPrvSE (elastic)
• Suspicious PDF Reader Child Process (elastic)
• Suspicious JetBrains TeamCity Child Process (elastic)
• Suspicious MS Office Child Process (elastic)
• Process Discovery Using Built-in Tools (elastic)
• Deprecated - PowerShell Script with Discovery Capabilities (elastic)
• Potential Memory Seeking Activity (elastic)
• Process Discovery via Built-In Applications (elastic)
• Suspicious Proc Pseudo File System Enumeration (elastic)
• System Service Discovery through built-in Windows Utilities (elastic)
• Windows Process Commandline Discovery (splunk)

Signal counts reflect the current corpus snapshot. Research citations are the technique IDs named in vendor reports and government advisories from the last 90 days; KEV mappings come from MITRE CTID. Coverage is the SigmaHQ rule inventory (core, emerging-threats, threat-hunting) at release r2026-07-01 plus Elastic and Splunk production rules. Rule bodies are not mirrored; links go upstream.