{"id":"T1057","name":"Process Discovery","url":"https://attack.mitre.org/techniques/T1057","tactics":["discovery"],"platforms":["ESXi","Linux","macOS","Network Devices","Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0034","stix_id":"x-mitre-detection-strategy--309ca3cd-d3f0-4aea-8932-558550aa89f4","name":"Detection of Adversarial Process Discovery Behavior","url":"https://attack.mitre.org/detectionstrategies/DET0034","analytics":[{"id":"AN0095","stix_id":"x-mitre-analytic--625983e7-9736-44f4-98ba-f372b3a3d236","name":"Analytic 0095","description":"Identifies adversary behavior that launches commands or invokes APIs to enumerate active processes (e.g., tasklist.exe, Get-Process, or CreateToolhelp32Snapshot). Detects execution combined with parent process lineage, network session context, or remote origin.","url":"https://attack.mitre.org/detectionstrategies/DET0034#AN0095","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Security","channel":"EventCode=4688","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-security"},{"name":"WinEventLog:Sysmon","channel":"EventCode=10","data_component":"DC0035","data_component_name":"Process Access","log_source_slug":"wineventlog-sysmon"}],"mutable_elements":[{"field":"ParentProcessName","description":"Used to scope suspicious discovery from non-interactive or non-standard parent processes like Office macros, WMI, or script engines"},{"field":"CommandLinePattern","description":"Adversaries may obfuscate or vary process discovery commands (e.g., aliases, PowerShell variants)"},{"field":"TimeWindow","description":"Helps detect bursty discovery behavior within a short timeframe"}],"live":true,"detection_strategies":["DET0034"],"techniques":["T1057"]},{"id":"AN0096","stix_id":"x-mitre-analytic--59aedd87-8373-45d3-93e3-5697e4cc7a48","name":"Analytic 0096","description":"Detects execution of common process enumeration utilities (e.g., ps, top, htop) or access to /proc with suspicious ancestry. Correlates command usage with interactive shell context and user role.","url":"https://attack.mitre.org/detectionstrategies/DET0034#AN0096","platforms":["Linux"],"log_source_references":[{"name":"auditd:SYSCALL","channel":"execve","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"auditd-syscall"},{"name":"auditd:SYSCALL","channel":"openat","data_component":"DC0055","data_component_name":"File Access","log_source_slug":"auditd-syscall"},{"name":"linux:osquery","channel":"Process State","data_component":"DC0035","data_component_name":"Process Access","log_source_slug":"linux-osquery"}],"mutable_elements":[{"field":"AccessedPath","description":"Filter based on suspicious /proc directory enumeration or high-volume ls/readlink usage"},{"field":"UserContext","description":"Helps tune for root vs. low-priv users during interactive vs. scripted activity"}],"live":true,"detection_strategies":["DET0034"],"techniques":["T1057"]},{"id":"AN0097","stix_id":"x-mitre-analytic--80939714-6d17-4cc0-accd-3e1d634846bc","name":"Analytic 0097","description":"Monitors execution of ps, top, or launchctl with unusual parent processes or from terminal scripts. Also detects AppleScript-based process listing or `system_profiler SPApplicationsDataType` misuse.","url":"https://attack.mitre.org/detectionstrategies/DET0034#AN0097","platforms":["macOS"],"log_source_references":[{"name":"macos:unifiedlog","channel":"process launch","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"macos-unifiedlog"},{"name":"macos:osquery","channel":"Process Context","data_component":"DC0034","data_component_name":"Process Metadata","log_source_slug":"macos-osquery"}],"mutable_elements":[{"field":"ParentApp","description":"Tunable to detect discovery from non-UI tools or script-based execution (osascript, zsh, cron)"}],"live":true,"detection_strategies":["DET0034"],"techniques":["T1057"]},{"id":"AN0098","stix_id":"x-mitre-analytic--7e029a7f-beb5-4da9-9d75-8fcfc812103b","name":"Analytic 0098","description":"Detects process enumeration using `esxcli system process list` or `ps` on ESXi shell or via unauthorized SSH sessions. Correlates with interactive sessions and abnormal user roles.","url":"https://attack.mitre.org/detectionstrategies/DET0034#AN0098","platforms":["ESXi"],"log_source_references":[{"name":"esxi:shell","channel":"interactive shell","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"esxi-shell"},{"name":"esxi:auth","channel":"user session","data_component":"DC0034","data_component_name":"Process Metadata","log_source_slug":"esxi-auth"}],"mutable_elements":[{"field":"User","description":"Admins are expected to run these commands—flag if non-admin or unknown users do"}],"live":true,"detection_strategies":["DET0034"],"techniques":["T1057"]},{"id":"AN0099","stix_id":"x-mitre-analytic--f6985c70-6de1-4600-aba0-5b3324184dce","name":"Analytic 0099","description":"Monitors CLI-based execution of `show process` or equivalent on routers/switches. Correlates unusual device access, unauthorized roles, or config mode changes.","url":"https://attack.mitre.org/detectionstrategies/DET0034#AN0099","platforms":["Network Devices"],"log_source_references":[{"name":"networkdevice:cli","channel":"CLI command","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"networkdevice-cli"},{"name":"networkdevice:syslog","channel":"Admin activity","data_component":"DC0034","data_component_name":"Process Metadata","log_source_slug":"networkdevice-syslog"}],"mutable_elements":[{"field":"Username","description":"Tunable based on authorized operators for network infrastructure"},{"field":"CommandString","description":"Pattern match or regex scope for discovery commands"}],"live":true,"detection_strategies":["DET0034"],"techniques":["T1057"]}],"live":true,"version":"1.0","techniques":["T1057"]}],"sigma_rules":[{"id":"221b251a-357a-49a9-920a-271802777cc0","title":"Potential Process Reconnaissance via Wmic.EXE","author":"frack113","status":"test","level":"medium","date":"2022-01-01","modified":"2025-12-15","description":"Detects the execution of \"wmic\" with the \"process\" flag, which might indicate an attempt to perform reconnaissance on running processes.\nAdversaries may use wmic to query for running processes and their details as part of their reconnaissance efforts.\n","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1047/T1047.md","https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wmic"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.t1047","attack.discovery","attack.t1057"],"path":"rules/windows/process_creation/proc_creation_win_wmic_recon_process.yml","techniques":["T1047","T1057"],"cves":[]},{"id":"4e2f5868-08d4-413d-899f-dc2f1508627b","title":"Process Discovery","author":"Ömer Günal, oscd.community, CheraaghiMilad","status":"stable","level":"low","date":"2020-10-06","modified":"2022-07-07","description":"Detects process discovery commands. Adversaries may attempt to get information about running processes on a system.\nInformation obtained could be used to gain an understanding of common software/applications running on systems within the network\n","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1057/T1057.md","https://www.cyberciti.biz/faq/show-all-running-processes-in-linux/"],"logsource":{"product":"linux","category":"process_creation"},"tags":["attack.discovery","attack.t1057","detection.threat-hunting"],"path":"rules-threat-hunting/linux/process_creation/proc_creation_lnx_susp_running_process_discovery.yml","techniques":["T1057"],"cves":[]},{"id":"63332011-f057-496c-ad8d-d2b6afb27f96","title":"Suspicious Tasklist Discovery Command","author":"frack113","status":"test","level":"informational","date":"2021-12-11","modified":"2022-12-25","description":"Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1057/T1057.md#atomic-test-2---process-discovery---tasklist"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.discovery","attack.t1057","detection.threat-hunting"],"path":"rules-threat-hunting/windows/process_creation/proc_creation_win_tasklist_basic_execution.yml","techniques":["T1057"],"cves":[]},{"id":"9705a6a1-6db6-4a16-a987-15b7151e299b","title":"Cisco Discovery","author":"Austin Clark","status":"test","level":"low","date":"2019-08-12","modified":"2023-01-04","description":"Find information about network devices that is not stored in config files","references":["https://www.cisco.com/c/en/us/td/docs/server_nw_virtual/2-5_release/command_reference/show.html"],"logsource":{"product":"cisco","service":"aaa"},"tags":["attack.discovery","attack.t1083","attack.t1201","attack.t1057","attack.t1018","attack.t1082","attack.t1016","attack.t1049","attack.t1033","attack.t1124"],"path":"rules/network/cisco/aaa/cisco_cli_discovery.yml","techniques":["T1083","T1201","T1057","T1018","T1082","T1016","T1049","T1033","T1124"],"cves":[]},{"id":"af4c87ce-bdda-4215-b998-15220772e993","title":"Suspicious Process Discovery With Get-Process","author":"frack113","status":"test","level":"low","date":"2022-03-17","modified":null,"description":"Get the processes that are running on the local computer.","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1057/T1057.md#atomic-test-3---process-discovery---get-process","https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-process?view=powershell-7.4"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.discovery","attack.t1057"],"path":"rules/windows/powershell/powershell_script/posh_ps_susp_get_process.yml","techniques":["T1057"],"cves":[]},{"id":"b207d563-a1d9-4275-b349-77d1eb55aa6d","title":"System Info Discovery via Sysinfo Syscall","author":"Milad Cheraghi","status":"experimental","level":"low","date":"2025-05-30","modified":"2025-12-05","description":"Detects use of the sysinfo system call in Linux, which provides a snapshot of key system statistics such as uptime, load averages, memory usage, and the number of running processes.\nMalware or reconnaissance tools might leverage sysinfo to fingerprint the system - gathering data to determine if it's a viable target.\n","references":["https://github.com/CheraghiMilad/bypass-Neo23x0-auditd-config/blob/f1c478a37911a5447d5ffcd580f22b167bf3df14/sysinfo-syscall/README.md","https://man7.org/linux/man-pages/man2/sysinfo.2.html"],"logsource":{"product":"linux","service":"auditd"},"tags":["attack.discovery","attack.t1057","attack.t1082"],"path":"rules/linux/auditd/syscall/lnx_auditd_susp_discovery_sysinfo_syscall.yml","techniques":["T1057","T1082"],"cves":[]},{"id":"ccb5742c-c248-4982-8c5c-5571b9275ad3","title":"Recon Command Output Piped To Findstr.EXE","author":"Nasreddine Bencherchali (Nextron Systems), frack113","status":"test","level":"medium","date":"2023-07-06","modified":"2025-10-08","description":"Detects the execution of a potential recon command where the results are piped to \"findstr\". This is meant to trigger on inline calls of \"cmd.exe\" via the \"/c\" or \"/k\" for example.\nAttackers often time use this technique to extract specific information they require in their reconnaissance phase.\n","references":["https://github.com/redcanaryco/atomic-red-team/blob/02cb591f75064ffe1e0df9ac3ed5972a2e491c97/atomics/T1057/T1057.md#atomic-test-6---discover-specific-process---tasklist","https://www.hhs.gov/sites/default/files/manage-engine-vulnerability-sector-alert-tlpclear.pdf","https://www.trendmicro.com/en_us/research/22/d/spring4shell-exploited-to-deploy-cryptocurrency-miners.html"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.discovery","attack.t1057"],"path":"rules/windows/process_creation/proc_creation_win_findstr_recon_pipe_output.yml","techniques":["T1057"],"cves":[]},{"id":"fca949cc-79ca-446e-8064-01aa7e52ece5","title":"HackTool - PCHunter Execution","author":"Florian Roth (Nextron Systems), Nasreddine Bencherchali","status":"test","level":"high","date":"2022-10-10","modified":"2024-11-23","description":"Detects suspicious use of PCHunter, a tool like Process Hacker to view and manipulate processes, kernel options and other low level stuff","references":["https://web.archive.org/web/20231210115125/http://www.xuetr.com/","https://www.crowdstrike.com/blog/falcon-overwatch-report-finds-increase-in-ecrime/","https://www.hexacorn.com/blog/2018/04/20/kernel-hacking-tool-you-might-have-never-heard-of-xuetr-pchunter/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.discovery","attack.t1082","attack.t1057","attack.t1012","attack.t1083","attack.t1007"],"path":"rules/windows/process_creation/proc_creation_win_hktl_pchunter.yml","techniques":["T1082","T1057","T1012","T1083","T1007"],"cves":[]}],"kev_cves":[],"_built":"2026-08-23 05:47 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}