{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1057","id":"T1057","name":"Process Discovery","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1057","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"b5dd2b437818af659b4c5e80b4317c12c4722227699ef0e0d94c98e2ef692a99","description":"Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Administrator or otherwise elevated access may provide better process details. Adversaries may use the information from [Process Discovery](https://attack.mitre.org/techniques/T1057) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.\n\nIn Windows environments, adversaries could obtain details on running processes using the [Tasklist](https://attack.mitre.org/software/S0057) utility via [cmd](https://attack.mitre.org/software/S0106) or <code>Get-Process</code> via [PowerShell](https://attack.mitre.org/techniques/T1059/001). Information about processes can also be extracted from the output of [Native API](https://attack.mitre.org/techniques/T1106) calls such as <code>CreateToolhelp32Snapshot</code>. In Mac and Linux, this is accomplished with the <code>ps</code> command. Adversaries may also opt to enumerate processes via `/proc`. ESXi also supports use of the `ps` command, as well as `esxcli system process list`.(Citation: Sygnia ESXi Ransomware 2025)(Citation: Crowdstrike Hypervisor Jackpotting Pt 2 2021)\n\nOn network devices, [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) commands such as `show processes` can be used to display current running processes.(Citation: US-CERT-TA18-106A)(Citation: show_processes_cisco_cmd)","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1057","external_id":"T1057"},{"source_name":"show_processes_cisco_cmd","description":"Cisco. (2022, August 16). show processes - . Retrieved July 13, 2022.","url":"https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/fundamentals/command/cf_command_ref/show_monitor_permit_list_through_show_process_memory.html#wp3599497760"},{"source_name":"Crowdstrike Hypervisor Jackpotting Pt 2 2021","description":"Michael Dawson. (2021, August 30). Hypervisor Jackpotting, Part 2: eCrime Actors Increase Targeting of ESXi Servers with Ransomware. Retrieved March 26, 2025.","url":"https://www.crowdstrike.com/en-us/blog/hypervisor-jackpotting-ecrime-actors-increase-targeting-of-esxi-servers/"},{"source_name":"US-CERT-TA18-106A","description":"US-CERT. (2018, April 20). Alert (TA18-106A) Russian State-Sponsored Cyber Actors Targeting Network Infrastructure Devices. Retrieved October 19, 2020.","url":"https://www.us-cert.gov/ncas/alerts/TA18-106A"},{"source_name":"Sygnia ESXi Ransomware 2025","description":"Zhongyuan Hau (Aaron), Ren Jie Yow, and Yoav Mazor. (2025, January 21). ESXi Ransomware Attacks: Stealthy Persistence through. Retrieved March 27, 2025.","url":"https://www.sygnia.co/blog/esxi-ransomware-ssh-tunneling-defense-strategies/"}],"platforms":["ESXi","Linux","macOS","Network Devices","Windows"],"environments":["cloud-hosted-endpoint","network-infrastructure","onprem","virtualization"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[],"telemetry":[{"id":"DC0064","name":"Command Execution","page":"telemetry/DC0064/","kind":"attack_component","category":"Script and command execution","description":"Execution of a command and its interpreter or parent context.","collection_focus":"Collect process command lines and relevant shell/interpreter audit; shell history alone is neither complete nor tamper-resistant.","providers":[{"name":"PowerShell Script Block Logging","scope":"Script content via event 4104 when configured; channel depends on PowerShell edition.","source_id":"powershell"},{"name":"Sysmon process events","scope":"Interpreter launch and parent context, not full script content.","source_id":"sysmon"},{"name":"Linux Audit","scope":"execve-family execution context; shell built-ins need additional instrumentation.","source_id":"linux"}],"configuration":["Enable Script Block Logging through the policy/configuration for the installed edition. Forward Microsoft-Windows-PowerShell/Operational for Windows PowerShell, or PowerShellCore/Operational for PowerShell 7.","Retain script-block ID and fragment ordering alongside process creation. Protect access to collected script text; secrets may be included.","On Linux, use narrowly scoped Audit execution rules for the lab account and supported architectures, and retain joined SYSCALL/EXECVE/PATH records."],"configuration_example":null,"required_fields":["interpreter","command_line","actor_uid","session_id"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0064","collector":"illustrative-lab-collector","observation":{"interpreter":"/bin/sh","command_line":"printf LAB_TELEMETRY_CHECK","actor_uid":1000,"session_id":"lab-session-1"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Script content and process command lines are different signals. Logging may be partial, fragmented, filtered or disabled; never assume a command line reveals everything executed.","sources":[{"id":"powershell","title":"Microsoft PowerShell logging on Windows","url":"https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_logging_windows?view=powershell-7.5"},{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"}],"association":"attack_component","anomaly_design":"Per host role and principal: rare interpreters, command argument patterns and parent-child sequences. Normalize scripts carefully; obfuscation, administrative automation and missing command lines change visibility."},{"id":"DC0055","name":"File Access","page":"telemetry/DC0055/","kind":"attack_component","category":"Windows and directory audit","description":"Access to file objects with user, process and access-right context.","collection_focus":"Enable Audit File System plus a narrow SACL on a lab directory; on Linux select path/syscall rules and join associated Audit records.","providers":[{"name":"Windows Security auditing","scope":"Policy-dependent account, object, task and logon records on the host that performs the operation.","source_id":"audit"}],"configuration":["Use a lab-only GPO under Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration. Enable the specific subcategory named below.","For object-level auditing, configure a narrow system access control list (SACL) on the test object in addition to policy. Do not audit an entire production directory by default.","Forward Security events from the responsible host or controller; retain subject and target identities, object identifiers, result and original XML. Confirm effective policy with auditpol /get /category:*."],"configuration_example":null,"required_fields":["path","access","actor","result"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0055","collector":"illustrative-lab-collector","observation":{"path":"C:\\Lab\\demo.txt","access":"read","actor":"LAB\\analyst","result":"success"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"A policy checkbox alone does not guarantee an event. Host role, SACL, success/failure selection and audit policy precedence matter. Directory changes may arrive as multiple records.","sources":[{"id":"audit","title":"Microsoft advanced security audit policy","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/advanced-security-audit-policy-settings"},{"id":"ad","title":"Microsoft Audit Directory Service Changes","url":"https://learn.microsoft.com/windows/security/threat-protection/auditing/audit-directory-service-changes"},{"id":"task","title":"Microsoft scheduled-task creation event 4698","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4698"}],"association":"attack_component","anomaly_design":"Per principal, host and object: unusual access/request rates, new principal-object relationships, and changes outside approved administration windows. Control for service accounts and scheduled directory maintenance."},{"id":"DC0035","name":"Process Access","page":"telemetry/DC0035/","kind":"attack_component","category":"Endpoint activity","description":"One process opening or accessing another process.","collection_focus":"Scope Sysmon ProcessAccess (10) to the selected source/target processes and access rights; retain call-trace fields where emitted.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["source_process_id","target_process_id","granted_access","action"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0035","collector":"illustrative-lab-collector","observation":{"source_process_id":4200,"target_process_id":4300,"granted_access":"0x1000","action":"open_process"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0032","name":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component","category":"Endpoint activity","description":"Creation of a process with executable, command line, parent and security context.","collection_focus":"Collect Sysmon ProcessCreate (1); preserve ProcessGuid and parent identifiers. Security 4688 is an alternative with separate audit/command-line settings.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":{"label":"Sysmon filter fragment · merge into the reviewed lab configuration","language":"xml","source_id":"sysmon_config","content":"<EventFiltering>\n  <ProcessCreate onmatch=\"include\">\n    <Image condition=\"is\">C:\\Windows\\System32\\whoami.exe</Image>\n  </ProcessCreate>\n</EventFiltering>","note":"This fragment only selects the named process. It is not a complete production policy. Inspect the installed schema with sysmon64 -s; preserve existing rules, then apply the reviewed complete configuration with sysmon64 -c <configuration-file>."},"required_fields":["process_guid","image","parent_image","command_line","user"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0034","name":"Process Metadata","page":"telemetry/DC0034/","kind":"attack_component","category":"Host state and inventory","description":"Point-in-time process properties such as owner, executable and start time.","collection_focus":"Collect read-only process inventory with PID plus start time/stable identity, command line and collection time; restrict access to potentially sensitive arguments.","providers":[{"name":"osquery","scope":"Scheduled host-state queries; supported tables and privileges vary by OS. Select a table that actually exposes the required object.","source_id":"osquery"},{"name":"Linux Audit plus inventory snapshots","scope":"Events explain changes; snapshots describe state at collection time.","source_id":"linux"}],"configuration":["Define the inventory query, allowed host set, interval and least-privileged reader. Store a stable asset ID, observation time and collector version.","Keep successive snapshots and calculate additions, removals and changed attributes. Pair state changes with audit events when available.","Export collector health and missed-poll counts so a missing snapshot is not misclassified as a missing asset."],"configuration_example":null,"required_fields":["process_id","image","owner_uid","started_at"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0034","collector":"illustrative-lab-collector","observation":{"process_id":4200,"image":"/usr/bin/sleep","owner_uid":1000,"started_at":"2026-09-27T11:59:00Z"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Snapshots miss short-lived objects and do not identify who caused a change. A generic inventory agent is not guaranteed to expose firmware or kernel-level details.","sources":[{"id":"osquery","title":"osquery scheduled configuration","url":"https://github.com/osquery/osquery/blob/master/docs/wiki/deployment/configuration.md"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"}],"association":"attack_component","anomaly_design":"Compare authorized state snapshots: first-seen drivers/services/modules, unexpected configuration drift and integrity changes. Record collection cadence; absence in a sample is not evidence of deletion."}],"detection":{"key":"enterprise/T1057","id":"T1057","name":"Process Discovery","domain":"enterprise","platforms":["ESXi","Linux","macOS","Network Devices","Windows"],"environments":["cloud-hosted-endpoint","network-infrastructure","onprem","virtualization"],"source_url":"https://attack.mitre.org/techniques/T1057","technique_page":"techniques/enterprise/T1057/","page":"detections/enterprise/T1057/","status":"rule_source_available","counts":{"sigma":6,"atlas_basic":1,"atlas_anomaly":0,"strategies":1,"analytics":5,"live_validated":0},"sigma_rules":[{"id":"b207d563-a1d9-4275-b349-77d1eb55aa6d","title":"System Info Discovery via Sysinfo Syscall","status":"experimental","level":"low","logsource":{"product":"linux","service":"auditd","definition":"Required auditd configuration:\n-a always,exit -F arch=b64 -S sysinfo -k discovery_sysinfo_syscall\n-a always,exit -F arch=b32 -S sysinfo -k discovery_sysinfo_syscall\n"},"data_path":"data/detection-rules/b207d563-a1d9-4275-b349-77d1eb55aa6d.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/auditd/syscall/lnx_auditd_susp_discovery_sysinfo_syscall.yml","author":"Milad Cheraghi","kind":"sigma"},{"id":"9705a6a1-6db6-4a16-a987-15b7151e299b","title":"Cisco Discovery","status":"test","level":"low","logsource":{"product":"cisco","service":"aaa"},"data_path":"data/detection-rules/9705a6a1-6db6-4a16-a987-15b7151e299b.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/network/cisco/aaa/cisco_cli_discovery.yml","author":"Austin Clark","kind":"sigma"},{"id":"af4c87ce-bdda-4215-b998-15220772e993","title":"Suspicious Process Discovery With Get-Process","status":"test","level":"low","logsource":{"product":"windows","category":"ps_script","definition":"Requirements: Script Block Logging must be enabled"},"data_path":"data/detection-rules/af4c87ce-bdda-4215-b998-15220772e993.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/powershell/powershell_script/posh_ps_susp_get_process.yml","author":"frack113","kind":"sigma"},{"id":"ccb5742c-c248-4982-8c5c-5571b9275ad3","title":"Recon Command Output Piped To Findstr.EXE","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/ccb5742c-c248-4982-8c5c-5571b9275ad3.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_findstr_recon_pipe_output.yml","author":"Nasreddine Bencherchali (Nextron Systems), frack113","kind":"sigma"},{"id":"fca949cc-79ca-446e-8064-01aa7e52ece5","title":"HackTool - PCHunter Execution","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/fca949cc-79ca-446e-8064-01aa7e52ece5.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_hktl_pchunter.yml","author":"Florian Roth (Nextron Systems), Nasreddine Bencherchali","kind":"sigma"},{"id":"221b251a-357a-49a9-920a-271802777cc0","title":"Potential Process Reconnaissance via Wmic.EXE","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/221b251a-357a-49a9-920a-271802777cc0.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_wmic_recon_process.yml","author":"frack113","kind":"sigma"}],"atlas_basic":[{"id":"atlas-basic-t1057-1","technique_id":"T1057","title":"T1057 Process Discovery","kind":"basic","source_url":"https://1200km.com/anomaly-detection-atlas/attack-basic-detection-rule-catalog/#discovery","source_path":"docs/attack-basic-detection-rule-catalog.md","source_line":131,"pinned_source_url":"https://github.com/anpa1200/anomaly-detection-atlas/blob/e1f75007376022b2f596e413bea8612e514a5aa3/docs/attack-basic-detection-rule-catalog.md#L131","source_file_sha256":"396a87e3d8da74d170684c0f377fe5dc11cd1a486d4f2f89f7fbe94deaaa2a1e","source_row_sha256":"bb1a58ee6e5bbde78cfb314e7ac4a453d8e36bcd8fba88af8a3718916a632482","validation":"published_concept_not_executable_or_live_validated","logic":"MATCH(command_or_api IN process_enumeration_operations) AND caller NOT_IN approved_tools -> ALERT","log_sources":[{"title":"Process Execution Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#6-process-execution-logs"},{"title":"Endpoint Detection and Response Telemetry","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#1-endpoint-detection-and-response-telemetry"}]}],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0034","name":"Detection of Adversarial Process Discovery Behavior","url":"https://attack.mitre.org/detectionstrategies/DET0034","stix_id":"x-mitre-detection-strategy--309ca3cd-d3f0-4aea-8932-558550aa89f4","relationship_id":"relationship--4da44310-3e7c-4d7c-934e-32d83935f5b0","description":"","analytics":[{"id":"AN0095","name":"Analytic 0095","guidance":"Identifies adversary behavior that launches commands or invokes APIs to enumerate active processes (e.g., tasklist.exe, Get-Process, or CreateToolhelp32Snapshot). Detects execution combined with parent process lineage, network session context, or remote origin.","url":"https://attack.mitre.org/detectionstrategies/DET0034#AN0095","platforms":["Windows"],"tuning":[{"field":"ParentProcessName","description":"Used to scope suspicious discovery from non-interactive or non-standard parent processes like Office macros, WMI, or script engines"},{"field":"CommandLinePattern","description":"Adversaries may obfuscate or vary process discovery commands (e.g., aliases, PowerShell variants)"},{"field":"TimeWindow","description":"Helps detect bursty discovery behavior within a short timeframe"}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"WinEventLog:Security","channel":"EventCode=4688","platforms":["Windows"],"analytic_id":"AN0095","source_url":"https://attack.mitre.org/detectionstrategies/DET0034#AN0095","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0035","component":"Process Access","name":"WinEventLog:Sysmon","channel":"EventCode=10","platforms":["Windows"],"analytic_id":"AN0095","source_url":"https://attack.mitre.org/detectionstrategies/DET0034#AN0095","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0035/"}]},{"id":"AN0096","name":"Analytic 0096","guidance":"Detects execution of common process enumeration utilities (e.g., ps, top, htop) or access to /proc with suspicious ancestry. Correlates command usage with interactive shell context and user role.","url":"https://attack.mitre.org/detectionstrategies/DET0034#AN0096","platforms":["Linux"],"tuning":[{"field":"AccessedPath","description":"Filter based on suspicious /proc directory enumeration or high-volume ls/readlink usage"},{"field":"UserContext","description":"Helps tune for root vs. low-priv users during interactive vs. scripted activity"}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"auditd:SYSCALL","channel":"execve","platforms":["Linux"],"analytic_id":"AN0096","source_url":"https://attack.mitre.org/detectionstrategies/DET0034#AN0096","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0055","component":"File Access","name":"auditd:SYSCALL","channel":"openat","platforms":["Linux"],"analytic_id":"AN0096","source_url":"https://attack.mitre.org/detectionstrategies/DET0034#AN0096","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0055/"},{"component_id":"DC0035","component":"Process Access","name":"linux:osquery","channel":"Process State","platforms":["Linux"],"analytic_id":"AN0096","source_url":"https://attack.mitre.org/detectionstrategies/DET0034#AN0096","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0035/"}]},{"id":"AN0097","name":"Analytic 0097","guidance":"Monitors execution of ps, top, or launchctl with unusual parent processes or from terminal scripts. Also detects AppleScript-based process listing or `system_profiler SPApplicationsDataType` misuse.","url":"https://attack.mitre.org/detectionstrategies/DET0034#AN0097","platforms":["macOS"],"tuning":[{"field":"ParentApp","description":"Tunable to detect discovery from non-UI tools or script-based execution (osascript, zsh, cron)"}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"macos:unifiedlog","channel":"process launch","platforms":["macOS"],"analytic_id":"AN0097","source_url":"https://attack.mitre.org/detectionstrategies/DET0034#AN0097","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0034","component":"Process Metadata","name":"macos:osquery","channel":"Process Context","platforms":["macOS"],"analytic_id":"AN0097","source_url":"https://attack.mitre.org/detectionstrategies/DET0034#AN0097","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0034/"}]},{"id":"AN0098","name":"Analytic 0098","guidance":"Detects process enumeration using `esxcli system process list` or `ps` on ESXi shell or via unauthorized SSH sessions. Correlates with interactive sessions and abnormal user roles.","url":"https://attack.mitre.org/detectionstrategies/DET0034#AN0098","platforms":["ESXi"],"tuning":[{"field":"User","description":"Admins are expected to run these commands—flag if non-admin or unknown users do"}],"log_sources":[{"component_id":"DC0064","component":"Command Execution","name":"esxi:shell","channel":"interactive shell","platforms":["ESXi"],"analytic_id":"AN0098","source_url":"https://attack.mitre.org/detectionstrategies/DET0034#AN0098","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0064/"},{"component_id":"DC0034","component":"Process Metadata","name":"esxi:auth","channel":"user session","platforms":["ESXi"],"analytic_id":"AN0098","source_url":"https://attack.mitre.org/detectionstrategies/DET0034#AN0098","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0034/"}]},{"id":"AN0099","name":"Analytic 0099","guidance":"Monitors CLI-based execution of `show process` or equivalent on routers/switches. Correlates unusual device access, unauthorized roles, or config mode changes.","url":"https://attack.mitre.org/detectionstrategies/DET0034#AN0099","platforms":["Network Devices"],"tuning":[{"field":"Username","description":"Tunable based on authorized operators for network infrastructure"},{"field":"CommandString","description":"Pattern match or regex scope for discovery commands"}],"log_sources":[{"component_id":"DC0064","component":"Command Execution","name":"networkdevice:cli","channel":"CLI command","platforms":["Network Devices"],"analytic_id":"AN0099","source_url":"https://attack.mitre.org/detectionstrategies/DET0034#AN0099","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0064/"},{"component_id":"DC0034","component":"Process Metadata","name":"networkdevice:syslog","channel":"Admin activity","platforms":["Network Devices"],"analytic_id":"AN0099","source_url":"https://attack.mitre.org/detectionstrategies/DET0034#AN0099","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0034/"}]}]}],"telemetry_references":[{"id":"DC0064","name":"Command Execution","tag":"Command Execution","page":"telemetry/DC0064/","kind":"attack_component"},{"id":"DC0055","name":"File Access","tag":"File Access","page":"telemetry/DC0055/","kind":"attack_component"},{"id":"DC0035","name":"Process Access","tag":"Process Access","page":"telemetry/DC0035/","kind":"attack_component"},{"id":"DC0032","name":"Process Creation","tag":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component"},{"id":"DC0034","name":"Process Metadata","tag":"Process Metadata","page":"telemetry/DC0034/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[{"id":"S1087","name":"AsyncRAT","page":"tools/S1087/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S1063","name":"Brute Ratel C4","page":"tools/S1063/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0154","name":"Cobalt Strike","page":"tools/S0154/","kind":"selected_framework","bases":["attack_uses"],"guides":[]},{"id":"S0695","name":"Donut","page":"tools/S0695/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0363","name":"Empire","page":"tools/S0363/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0434","name":"Imminent Monitor","page":"tools/S0434/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0581","name":"IronNetInjector","page":"tools/S0581/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S1050","name":"PcShare","page":"tools/S1050/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0194","name":"PowerSploit","page":"tools/S0194/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0192","name":"Pupy","page":"tools/S0192/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0332","name":"Remcos","page":"tools/S0332/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0445","name":"ShimRatReporter","page":"tools/S0445/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0692","name":"SILENTTRINITY","page":"tools/S0692/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0057","name":"Tasklist","page":"tools/S0057/","kind":"attack_tool","bases":["attack_uses"],"guides":[]}],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[{"id":"S1087","name":"AsyncRAT","page":"tools/S1087/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S1063","name":"Brute Ratel C4","page":"tools/S1063/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0154","name":"Cobalt Strike","page":"tools/S0154/","kind":"selected_framework","bases":["attack_uses"],"guides":[]},{"id":"S0695","name":"Donut","page":"tools/S0695/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0363","name":"Empire","page":"tools/S0363/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0434","name":"Imminent Monitor","page":"tools/S0434/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0581","name":"IronNetInjector","page":"tools/S0581/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S1050","name":"PcShare","page":"tools/S1050/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0194","name":"PowerSploit","page":"tools/S0194/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0192","name":"Pupy","page":"tools/S0192/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0332","name":"Remcos","page":"tools/S0332/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0445","name":"ShimRatReporter","page":"tools/S0445/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0692","name":"SILENTTRINITY","page":"tools/S0692/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0057","name":"Tasklist","page":"tools/S0057/","kind":"attack_tool","bases":["attack_uses"],"guides":[]}],"software":[{"id":"S0011","name":"Taidoor","url":"https://attack.mitre.org/software/S0011","kind":"malware","description":"[Taidoor](https://attack.mitre.org/software/S0011) can use <code>GetCurrentProcessId</code> for process discovery.(Citation: CISA MAR-10292089-1.v2 TAIDOOR August 2021)","relationship_id":"relationship--ced0348f-1bc8-461b-8123-a1b3aeb38e94","references":[{"source_name":"CISA MAR-10292089-1.v2 TAIDOOR August 2021","description":"CISA, FBI, DOD. (2021, August). MAR-10292089-1.v2 – Chinese Remote Access Trojan: TAIDOOR. Retrieved August 24, 2021.","url":"https://us-cert.cisa.gov/ncas/analysis-reports/ar20-216a"}]},{"id":"S0013","name":"PlugX","url":"https://attack.mitre.org/software/S0013","kind":"malware","description":"[PlugX](https://attack.mitre.org/software/S0013) has a module to list the processes running on a machine.(Citation: CIRCL PlugX March 2013)","relationship_id":"relationship--4b8ebd1a-50ba-463a-b536-3ad8cc5013f8","references":[{"source_name":"CIRCL PlugX March 2013","description":"Computer Incident Response Center Luxembourg. (2013, March 29). Analysis of a PlugX variant. Retrieved November 5, 2018.","url":"http://circl.lu/assets/files/tr-12/tr-12-circl-plugx-analysis-v1.pdf"}]},{"id":"S0015","name":"Ixeshe","url":"https://attack.mitre.org/software/S0015","kind":"malware","description":"[Ixeshe](https://attack.mitre.org/software/S0015) can list running processes.(Citation: Trend Micro IXESHE 2012)","relationship_id":"relationship--1e0fdaa6-7a6f-4bd6-a1ef-3ee85d1d89b2","references":[{"source_name":"Trend Micro IXESHE 2012","description":"Sancho, D., et al. (2012, May 22). IXESHE An APT Campaign. Retrieved June 7, 2019.","url":"https://www.trendmicro.de/cloud-content/us/pdfs/security-intelligence/white-papers/wp_ixeshe.pdf"}]},{"id":"S0017","name":"BISCUIT","url":"https://attack.mitre.org/software/S0017","kind":"malware","description":"[BISCUIT](https://attack.mitre.org/software/S0017) has a command to enumerate running processes and identify their owners.(Citation: Mandiant APT1 Appendix)","relationship_id":"relationship--93fe5493-d3c1-4db2-8228-61da951c660e","references":[{"source_name":"Mandiant APT1 Appendix","description":"Mandiant. (n.d.). Appendix C (Digital) - The Malware Arsenal. Retrieved July 18, 2016.","url":"https://www.mandiant.com/sites/default/files/2021-09/mandiant-apt1-report.pdf"}]},{"id":"S0018","name":"Sykipot","url":"https://attack.mitre.org/software/S0018","kind":"malware","description":"[Sykipot](https://attack.mitre.org/software/S0018) may gather a list of running processes by running <code>tasklist /v</code>.(Citation: AlienVault Sykipot 2011)","relationship_id":"relationship--4438ba64-0cd2-46e9-8a67-c685bf9b404c","references":[{"source_name":"AlienVault Sykipot 2011","description":"Blasco, J. (2011, December 12). Another Sykipot sample likely targeting US federal agencies. Retrieved March 28, 2016.","url":"https://www.alienvault.com/open-threat-exchange/blog/another-sykipot-sample-likely-targeting-us-federal-agencies"}]},{"id":"S0021","name":"Derusbi","url":"https://attack.mitre.org/software/S0021","kind":"malware","description":"[Derusbi](https://attack.mitre.org/software/S0021) collects current and parent process IDs.(Citation: Fidelis Turbo)(Citation: FireEye Periscope March 2018)","relationship_id":"relationship--f017f6c0-96f4-46f1-905f-44e9950effbc","references":[{"source_name":"Fidelis Turbo","description":"Fidelis Cybersecurity. (2016, February 29). The Turbo Campaign, Featuring Derusbi for 64-bit Linux. Retrieved March 2, 2016.","url":"https://paper.seebug.org/papers/APT/APT_CyberCriminal_Campagin/2016/2016.02.29.Turbo_Campaign_Derusbi/TA_Fidelis_Turbo_1602_0.pdf"},{"source_name":"FireEye Periscope March 2018","description":"FireEye. (2018, March 16). Suspected Chinese Cyber Espionage Group (TEMP.Periscope) Targeting U.S. Engineering and Maritime Industries. Retrieved April 11, 2018.","url":"https://www.fireeye.com/blog/threat-research/2018/03/suspected-chinese-espionage-group-targeting-maritime-and-engineering-industries.html"}]},{"id":"S0022","name":"Uroburos","url":"https://attack.mitre.org/software/S0022","kind":"malware","description":"[Uroburos](https://attack.mitre.org/software/S0022) can use its `Process List` command to enumerate processes on compromised hosts.(Citation: Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023)","relationship_id":"relationship--db75183b-9ad3-41e4-9730-f0bba5ef55c1","references":[{"source_name":"Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023","description":"FBI et al. (2023, May 9). Hunting Russian Intelligence “Snake” Malware. Retrieved June 8, 2023.","url":"https://www.cisa.gov/sites/default/files/2023-05/aa23-129a_snake_malware_2.pdf"}]},{"id":"S0030","name":"Carbanak","url":"https://attack.mitre.org/software/S0030","kind":"malware","description":"[Carbanak](https://attack.mitre.org/software/S0030) lists running processes.(Citation: FireEye CARBANAK June 2017)","relationship_id":"relationship--6a09f442-6a2a-455a-ad8d-6aa192995de3","references":[{"source_name":"FireEye CARBANAK June 2017","description":"Bennett, J., Vengerik, B. (2017, June 12). Behind the CARBANAK Backdoor. Retrieved June 11, 2018.","url":"https://www.fireeye.com/blog/threat-research/2017/06/behind-the-carbanak-backdoor.html"}]},{"id":"S0031","name":"BACKSPACE","url":"https://attack.mitre.org/software/S0031","kind":"malware","description":"[BACKSPACE](https://attack.mitre.org/software/S0031) may collect information about running processes.(Citation: FireEye APT30)","relationship_id":"relationship--64cb753d-eb72-4dce-a417-7df747334347","references":[{"source_name":"FireEye APT30","description":"FireEye Labs. (2015, April). APT30 AND THE MECHANICS OF A LONG-RUNNING CYBER ESPIONAGE OPERATION. Retrieved November 17, 2024.","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2015/05/20081935/rpt-apt30.pdf"}]},{"id":"S0032","name":"gh0st RAT","url":"https://attack.mitre.org/software/S0032","kind":"malware","description":"[gh0st RAT](https://attack.mitre.org/software/S0032) has the capability to list processes.(Citation: FireEye Hacking Team)","relationship_id":"relationship--a564f3da-349a-4e65-826c-8ca60bc920bf","references":[{"source_name":"FireEye Hacking Team","description":"FireEye Threat Intelligence. (2015, July 13). Demonstrating Hustle, Chinese APT Groups Quickly Use Zero-Day Vulnerability (CVE-2015-5119) Following Hacking Team Leak. Retrieved January 25, 2016.","url":"https://www.fireeye.com/blog/threat-research/2015/07/demonstrating_hustle.html"}]},{"id":"S0034","name":"NETEAGLE","url":"https://attack.mitre.org/software/S0034","kind":"malware","description":"[NETEAGLE](https://attack.mitre.org/software/S0034) can send process listings over the C2 channel.(Citation: FireEye APT30)","relationship_id":"relationship--16043223-3846-4138-93d0-671339ba3646","references":[{"source_name":"FireEye APT30","description":"FireEye Labs. (2015, April). APT30 AND THE MECHANICS OF A LONG-RUNNING CYBER ESPIONAGE OPERATION. Retrieved November 17, 2024.","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2015/05/20081935/rpt-apt30.pdf"}]},{"id":"S0038","name":"Duqu","url":"https://attack.mitre.org/software/S0038","kind":"malware","description":"The discovery modules used with [Duqu](https://attack.mitre.org/software/S0038) can collect information on process details.(Citation: Symantec W32.Duqu)","relationship_id":"relationship--3b0a7f6a-173f-41e6-8dec-2d1b4a0851d9","references":[{"source_name":"Symantec W32.Duqu","description":"Symantec Security Response. (2011, November). W32.Duqu: The precursor to the next Stuxnet. Retrieved September 17, 2015.","url":"https://web.archive.org/web/20111213083345/https://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/w32_duqu_the_precursor_to_the_next_stuxnet.pdf"}]},{"id":"S0044","name":"JHUHUGIT","url":"https://attack.mitre.org/software/S0044","kind":"malware","description":"[JHUHUGIT](https://attack.mitre.org/software/S0044) obtains a list of running processes on the victim.(Citation: ESET Sednit Part 1)(Citation: Unit 42 Sofacy Feb 2018)","relationship_id":"relationship--1923a47b-5a48-44e6-883f-ca23a96fea46","references":[{"source_name":"ESET Sednit Part 1","description":"ESET. (2016, October). En Route with Sednit - Part 1: Approaching the Target. Retrieved November 8, 2016.","url":"http://www.welivesecurity.com/wp-content/uploads/2016/10/eset-sednit-part1.pdf"},{"source_name":"Unit 42 Sofacy Feb 2018","description":"Lee, B, et al. (2018, February 28). Sofacy Attacks Multiple Government Entities. Retrieved March 15, 2018.","url":"https://researchcenter.paloaltonetworks.com/2018/02/unit42-sofacy-attacks-multiple-government-entities/"}]},{"id":"S0045","name":"ADVSTORESHELL","url":"https://attack.mitre.org/software/S0045","kind":"malware","description":"[ADVSTORESHELL](https://attack.mitre.org/software/S0045) can list running processes.(Citation: ESET Sednit Part 2)","relationship_id":"relationship--66819f02-7a22-4f21-8e4f-df24969e5567","references":[{"source_name":"ESET Sednit Part 2","description":"ESET. (2016, October). En Route with Sednit - Part 2: Observing the Comings and Goings. Retrieved November 21, 2016.","url":"http://www.welivesecurity.com/wp-content/uploads/2016/10/eset-sednit-part-2.pdf"}]},{"id":"S0049","name":"GeminiDuke","url":"https://attack.mitre.org/software/S0049","kind":"malware","description":"[GeminiDuke](https://attack.mitre.org/software/S0049) collects information on running processes and environment variables from the victim.(Citation: F-Secure The Dukes)","relationship_id":"relationship--3363ae54-1fe3-4c9f-b074-79dc0d7fbba5","references":[{"source_name":"F-Secure The Dukes","description":"F-Secure Labs. (2015, September 17). The Dukes: 7 years of Russian cyberespionage. Retrieved December 10, 2015.","url":"https://www.f-secure.com/documents/996508/1030745/dukes_whitepaper.pdf"}]},{"id":"S0057","name":"Tasklist","url":"https://attack.mitre.org/software/S0057","kind":"tool","description":"[Tasklist](https://attack.mitre.org/software/S0057) can be used to discover processes running on a system.(Citation: Microsoft Tasklist)","relationship_id":"relationship--32a470e7-4bbc-43e8-ae8e-09b382dd441f","references":[{"source_name":"Microsoft Tasklist","description":"Microsoft. (n.d.). Tasklist. Retrieved December 23, 2015.","url":"https://technet.microsoft.com/en-us/library/bb491010.aspx"}]},{"id":"S0059","name":"WinMM","url":"https://attack.mitre.org/software/S0059","kind":"malware","description":"[WinMM](https://attack.mitre.org/software/S0059) sets a WH_CBT Windows hook to collect information on process creation.(Citation: Baumgartner Naikon 2015)","relationship_id":"relationship--13204383-a747-4f7f-a75c-858ddc76beab","references":[{"source_name":"Baumgartner Naikon 2015","description":"Baumgartner, K., Golovkin, M.. (2015, May). The MsnMM Campaigns: The Earliest Naikon APT Campaigns. Retrieved April 10, 2019.","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/07205555/TheNaikonAPT-MsnMM1.pdf"}]},{"id":"S0062","name":"DustySky","url":"https://attack.mitre.org/software/S0062","kind":"malware","description":"[DustySky](https://attack.mitre.org/software/S0062) collects information about running processes from victims.(Citation: DustySky)(Citation: Kaspersky MoleRATs April 2019)","relationship_id":"relationship--f33725f4-cce5-4868-b494-d73419c76bdf","references":[{"source_name":"DustySky","description":"ClearSky. (2016, January 7). Operation DustySky. Retrieved January 8, 2016.","url":"https://www.clearskysec.com/wp-content/uploads/2016/01/Operation%20DustySky_TLP_WHITE.pdf"},{"source_name":"Kaspersky MoleRATs April 2019","description":"GReAT. (2019, April 10). Gaza Cybergang Group1, operation SneakyPastes. Retrieved May 13, 2020.","url":"https://securelist.com/gaza-cybergang-group1-operation-sneakypastes/90068/"}]},{"id":"S0063","name":"SHOTPUT","url":"https://attack.mitre.org/software/S0063","kind":"malware","description":"[SHOTPUT](https://attack.mitre.org/software/S0063) has a command to obtain a process listing.(Citation: Palo Alto CVE-2015-3113 July 2015)","relationship_id":"relationship--c8ce3bcd-b74f-497d-8f76-cc8c7333ab49","references":[{"source_name":"Palo Alto CVE-2015-3113 July 2015","description":"Falcone, R. and Wartell, R.. (2015, July 27). Observations on CVE-2015-3113, Prior Zero-Days and the Pirpi Payload. Retrieved January 22, 2016.","url":"http://researchcenter.paloaltonetworks.com/2015/07/ups-observations-on-cve-2015-3113-prior-zero-days-and-the-pirpi-payload/"}]},{"id":"S0064","name":"ELMER","url":"https://attack.mitre.org/software/S0064","kind":"malware","description":"[ELMER](https://attack.mitre.org/software/S0064) is capable of performing process listings.(Citation: FireEye EPS Awakens Part 2)","relationship_id":"relationship--771c349e-1b23-41ea-bcab-59bdbd6c935f","references":[{"source_name":"FireEye EPS Awakens Part 2","description":"Winters, R. (2015, December 20). The EPS Awakens - Part 2. Retrieved January 22, 2016.","url":"https://web.archive.org/web/20151226205946/https://www.fireeye.com/blog/threat-research/2015/12/the-eps-awakens-part-two.html"}]},{"id":"S0065","name":"4H RAT","url":"https://attack.mitre.org/software/S0065","kind":"malware","description":"[4H RAT](https://attack.mitre.org/software/S0065) has the capability to obtain a listing of running processes (including loaded modules).(Citation: CrowdStrike Putter Panda)","relationship_id":"relationship--71ee5336-929a-41c7-bfbd-42a7208ca29d","references":[{"source_name":"CrowdStrike Putter Panda","description":"Crowdstrike Global Intelligence Team. (2014, June 9). CrowdStrike Intelligence Report: Putter Panda. Retrieved January 22, 2016.","url":"http://cdn0.vox-cdn.com/assets/4589853/crowdstrike-intelligence-report-putter-panda.original.pdf"}]},{"id":"S0069","name":"BLACKCOFFEE","url":"https://attack.mitre.org/software/S0069","kind":"malware","description":"[BLACKCOFFEE](https://attack.mitre.org/software/S0069) has the capability to discover processes.(Citation: FireEye APT17)","relationship_id":"relationship--5a77e097-3aed-4bd3-b5fc-997746da62ad","references":[{"source_name":"FireEye APT17","description":"FireEye Labs/FireEye Threat Intelligence. (2015, May 14). Hiding in Plain Sight: FireEye and Microsoft Expose Obfuscation Tactic. Retrieved November 17, 2024.","url":"https://web.archive.org/web/20240119213200/https://www2.fireeye.com/rs/fireye/images/APT17_Report.pdf"}]},{"id":"S0079","name":"MobileOrder","url":"https://attack.mitre.org/software/S0079","kind":"malware","description":"[MobileOrder](https://attack.mitre.org/software/S0079) has a command to upload information about all running processes to its C2 server.(Citation: Scarlet Mimic Jan 2016)","relationship_id":"relationship--6fdaef62-c4da-488a-a07d-c8fca2c98d85","references":[{"source_name":"Scarlet Mimic Jan 2016","description":"Falcone, R. and Miller-Osborn, J.. (2016, January 24). Scarlet Mimic: Years-Long Espionage Campaign Targets Minority Activists. Retrieved February 10, 2016.","url":"http://researchcenter.paloaltonetworks.com/2016/01/scarlet-mimic-years-long-espionage-targets-minority-activists/"}]},{"id":"S0081","name":"Elise","url":"https://attack.mitre.org/software/S0081","kind":"malware","description":"[Elise](https://attack.mitre.org/software/S0081) enumerates processes via the <code>tasklist</code> command.(Citation: Accenture Dragonfish Jan 2018)","relationship_id":"relationship--496378e6-ab36-4d3b-9ae3-c493a5b56877","references":[{"source_name":"Accenture Dragonfish Jan 2018","description":"Accenture Security. (2018, January 27). DRAGONFISH DELIVERS NEW FORM OF ELISE MALWARE TARGETING ASEAN DEFENCE MINISTERS’ MEETING AND ASSOCIATES. Retrieved November 17, 2024.","url":"https://web.archive.org/web/20190508165226/https://www.accenture.com/t20180127T003755Z_w_/us-en/_acnmedia/PDF-46/Accenture-Security-Dragonfish-Threat-Analysis.pdf"}]},{"id":"S0088","name":"Kasidet","url":"https://attack.mitre.org/software/S0088","kind":"malware","description":"[Kasidet](https://attack.mitre.org/software/S0088) has the ability to search for a given process name in processes currently running in the system.(Citation: Zscaler Kasidet)","relationship_id":"relationship--4d90fd9d-9f9b-45f8-986d-3db43b679905","references":[{"source_name":"Zscaler Kasidet","description":"Yadav, A., et al. (2016, January 29). Malicious Office files dropping Kasidet and Dridex. Retrieved March 24, 2016.","url":"http://research.zscaler.com/2016/01/malicious-office-files-dropping-kasidet.html"}]},{"id":"S0089","name":"BlackEnergy","url":"https://attack.mitre.org/software/S0089","kind":"malware","description":"[BlackEnergy](https://attack.mitre.org/software/S0089) has gathered a process list by using [Tasklist](https://attack.mitre.org/software/S0057).exe.(Citation: F-Secure BlackEnergy 2014)(Citation: Securelist BlackEnergy Nov 2014)(Citation: ESET BlackEnergy Jan 2016)","relationship_id":"relationship--2c586158-d02b-468a-bee8-04e1bde320e1","references":[{"source_name":"F-Secure BlackEnergy 2014","description":"F-Secure Labs. (2014). BlackEnergy & Quedagh: The convergence of crimeware and APT attacks. Retrieved March 24, 2016.","url":"https://blog-assets.f-secure.com/wp-content/uploads/2019/10/15163408/BlackEnergy_Quedagh.pdf"},{"source_name":"Securelist BlackEnergy Nov 2014","description":"Baumgartner, K. and Garnaeva, M.. (2014, November 3). BE2 custom plugins, router abuse, and target profiles. Retrieved March 24, 2016.","url":"https://securelist.com/be2-custom-plugins-router-abuse-and-target-profiles/67353/"},{"source_name":"ESET BlackEnergy Jan 2016","description":"Cherepanov, A.. (2016, January 3). BlackEnergy by the SSHBearDoor: attacks against Ukrainian news media and electric industry . Retrieved June 10, 2020.","url":"https://www.welivesecurity.com/2016/01/03/blackenergy-sshbeardoor-details-2015-attacks-ukrainian-news-media-electric-industry/"}]},{"id":"S0091","name":"Epic","url":"https://attack.mitre.org/software/S0091","kind":"malware","description":"[Epic](https://attack.mitre.org/software/S0091) uses the <code>tasklist /v</code> command to obtain a list of processes.(Citation: Kaspersky Turla)(Citation: Kaspersky Turla Aug 2014)","relationship_id":"relationship--01f98d14-77b9-439f-8b44-920fcaca2b2b","references":[{"source_name":"Kaspersky Turla","description":"Kaspersky Lab's Global Research and Analysis Team. (2014, August 7). The Epic Turla Operation: Solving some of the mysteries of Snake/Uroburos. Retrieved December 11, 2014.","url":"https://securelist.com/the-epic-turla-operation/65545/"},{"source_name":"Kaspersky Turla Aug 2014","description":"Kaspersky Lab's Global Research & Analysis Team. (2014, August 06). The Epic Turla Operation: Solving some of the mysteries of Snake/Uroboros. Retrieved November 7, 2018.","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/08080105/KL_Epic_Turla_Technical_Appendix_20140806.pdf"}]},{"id":"S0093","name":"Backdoor.Oldrea","url":"https://attack.mitre.org/software/S0093","kind":"malware","description":"[Backdoor.Oldrea](https://attack.mitre.org/software/S0093) collects information about running processes.(Citation: Symantec Dragonfly)","relationship_id":"relationship--b6ae274b-f0b3-4694-ab8d-37e0c62cff35","references":[{"source_name":"Symantec Dragonfly","description":"Symantec Security Response. (2014, June 30). Dragonfly: Cyberespionage Attacks Against Energy Suppliers. Retrieved April 8, 2016.","url":"https://community.broadcom.com/symantecenterprise/communities/community-home/librarydocuments/viewdocument?DocumentKey=7382dce7-0260-4782-84cc-890971ed3f17&CommunityKey=1ecf5f55-9545-44d6-b0f4-4e4a7f5f5e68&tab=librarydocuments"}]},{"id":"S0094","name":"Trojan.Karagany","url":"https://attack.mitre.org/software/S0094","kind":"malware","description":"[Trojan.Karagany](https://attack.mitre.org/software/S0094) can use [Tasklist](https://attack.mitre.org/software/S0057) to collect a list of running tasks.(Citation: Symantec Dragonfly)(Citation: Secureworks Karagany July 2019)","relationship_id":"relationship--51a03c8a-1983-4bdd-b326-78ec67f86f06","references":[{"source_name":"Symantec Dragonfly","description":"Symantec Security Response. (2014, June 30). Dragonfly: Cyberespionage Attacks Against Energy Suppliers. Retrieved April 8, 2016.","url":"https://community.broadcom.com/symantecenterprise/communities/community-home/librarydocuments/viewdocument?DocumentKey=7382dce7-0260-4782-84cc-890971ed3f17&CommunityKey=1ecf5f55-9545-44d6-b0f4-4e4a7f5f5e68&tab=librarydocuments"},{"source_name":"Secureworks Karagany July 2019","description":"Secureworks. (2019, July 24). Updated Karagany Malware Targets Energy Sector. Retrieved August 12, 2020.","url":"https://www.secureworks.com/research/updated-karagany-malware-targets-energy-sector"}]},{"id":"S0115","name":"Crimson","url":"https://attack.mitre.org/software/S0115","kind":"malware","description":"[Crimson](https://attack.mitre.org/software/S0115) contains a command to list processes.(Citation: Proofpoint Operation Transparent Tribe March 2016)(Citation: Kaspersky Transparent Tribe August 2020)(Citation: Cisco Talos Transparent Tribe Education Campaign July 2022)\t ","relationship_id":"relationship--84f40044-00a2-4015-be0d-1bb0107ef42b","references":[{"source_name":"Kaspersky Transparent Tribe August 2020","description":"Dedola, G. (2020, August 20). Transparent Tribe: Evolution analysis, part 1. Retrieved September 2, 2021.","url":"https://securelist.com/transparent-tribe-part-1/98127/"},{"source_name":"Proofpoint Operation Transparent Tribe March 2016","description":"Huss, D. (2016, March 1). Operation Transparent Tribe. Retrieved June 8, 2016.","url":"https://www.proofpoint.com/sites/default/files/proofpoint-operation-transparent-tribe-threat-insight-en.pdf"},{"source_name":"Cisco Talos Transparent Tribe Education Campaign July 2022","description":"N. Baisini. (2022, July 13). Transparent Tribe begins targeting education sector in latest campaign. Retrieved September 22, 2022.","url":"https://blog.talosintelligence.com/2022/07/transparent-tribe-targets-education.html"}]},{"id":"S0125","name":"Remsec","url":"https://attack.mitre.org/software/S0125","kind":"malware","description":"[Remsec](https://attack.mitre.org/software/S0125) can obtain a process list from the victim.(Citation: Kaspersky ProjectSauron Technical Analysis)","relationship_id":"relationship--3076f49e-0db2-4652-a07d-653027aeef1e","references":[{"source_name":"Kaspersky ProjectSauron Technical Analysis","description":"Kaspersky Lab's Global Research & Analysis Team. (2016, August 9). The ProjectSauron APT. Technical Analysis. Retrieved August 17, 2016.","url":"https://securelist.com/files/2016/07/The-ProjectSauron-APT_Technical_Analysis_KL.pdf"}]},{"id":"S0127","name":"BBSRAT","url":"https://attack.mitre.org/software/S0127","kind":"malware","description":"[BBSRAT](https://attack.mitre.org/software/S0127) can list running processes.(Citation: Palo Alto Networks BBSRAT)","relationship_id":"relationship--b82f51f9-74a0-43e1-b3c6-63df3a90c9eb","references":[{"source_name":"Palo Alto Networks BBSRAT","description":"Lee, B. Grunzweig, J. (2015, December 22). BBSRAT Attacks Targeting Russian Organizations Linked to Roaming Tiger. Retrieved August 19, 2016.","url":"http://researchcenter.paloaltonetworks.com/2015/12/bbsrat-attacks-targeting-russian-organizations-linked-to-roaming-tiger/"}]},{"id":"S0139","name":"PowerDuke","url":"https://attack.mitre.org/software/S0139","kind":"malware","description":"[PowerDuke](https://attack.mitre.org/software/S0139) has a command to list the victim's processes.(Citation: Volexity PowerDuke November 2016)","relationship_id":"relationship--62f9aa2c-b0c1-4028-a2b8-c436e30ace4b","references":[{"source_name":"Volexity PowerDuke November 2016","description":"Adair, S.. (2016, November 9). PowerDuke: Widespread Post-Election Spear Phishing Campaigns Targeting Think Tanks and NGOs. Retrieved January 11, 2017.","url":"https://www.volexity.com/blog/2016/11/09/powerduke-post-election-spear-phishing-campaigns-targeting-think-tanks-and-ngos/"}]},{"id":"S0141","name":"Winnti for Windows","url":"https://attack.mitre.org/software/S0141","kind":"malware","description":"[Winnti for Windows](https://attack.mitre.org/software/S0141) can check if the explorer.exe process is responsible for calling its install function.(Citation: Novetta Winnti April 2015)","relationship_id":"relationship--563e67ee-9cc8-4f44-9d3a-3611e19a1a3c","references":[{"source_name":"Novetta Winnti April 2015","description":"Novetta Threat Research Group. (2015, April 7). Winnti Analysis. Retrieved February 8, 2017.","url":"https://web.archive.org/web/20150412223949/http://www.novetta.com/wp-content/uploads/2015/04/novetta_winntianalysis.pdf"}]},{"id":"S0142","name":"StreamEx","url":"https://attack.mitre.org/software/S0142","kind":"malware","description":"[StreamEx](https://attack.mitre.org/software/S0142) has the ability to enumerate processes.(Citation: Cylance Shell Crew Feb 2017)","relationship_id":"relationship--0cbc1f3f-7a32-4056-bfa6-25186ac5e6a4","references":[{"source_name":"Cylance Shell Crew Feb 2017","description":"Cylance SPEAR Team. (2017, February 9). Shell Crew Variants Continue to Fly Under Big AV’s Radar. Retrieved February 15, 2017.","url":"https://www.cylance.com/shell-crew-variants-continue-to-fly-under-big-avs-radar"}]},{"id":"S0144","name":"ChChes","url":"https://attack.mitre.org/software/S0144","kind":"malware","description":"[ChChes](https://attack.mitre.org/software/S0144) collects its process identifier (PID) on the victim.(Citation: Palo Alto menuPass Feb 2017)","relationship_id":"relationship--e6f69552-fe0e-4b40-ad20-4410048277e6","references":[{"source_name":"Palo Alto menuPass Feb 2017","description":"Miller-Osborn, J. and Grunzweig, J.. (2017, February 16). menuPass Returns with New Malware and New Attacks Against Japanese Academics and Organizations. Retrieved March 1, 2017.","url":"http://researchcenter.paloaltonetworks.com/2017/02/unit42-menupass-returns-new-malware-new-attacks-japanese-academics-organizations/"}]},{"id":"S0148","name":"RTM","url":"https://attack.mitre.org/software/S0148","kind":"malware","description":"[RTM](https://attack.mitre.org/software/S0148) can obtain information about process integrity levels.(Citation: ESET RTM Feb 2017)","relationship_id":"relationship--f0cf3ea2-5345-48d7-9685-be0180eb0e4a","references":[{"source_name":"ESET RTM Feb 2017","description":"Faou, M. and Boutin, J. (2017, February). Read The Manual: A Guide to the RTM Banking Trojan. Retrieved March 9, 2017.","url":"https://www.welivesecurity.com/wp-content/uploads/2017/02/Read-The-Manual.pdf"}]},{"id":"S0149","name":"MoonWind","url":"https://attack.mitre.org/software/S0149","kind":"malware","description":"[MoonWind](https://attack.mitre.org/software/S0149) has a command to return a list of running processes.(Citation: Palo Alto MoonWind March 2017)","relationship_id":"relationship--1035fe41-56b9-4966-bf3b-109ae950c908","references":[{"source_name":"Palo Alto MoonWind March 2017","description":"Miller-Osborn, J. and Grunzweig, J.. (2017, March 30). Trochilus and New MoonWind RATs Used In Attack Against Thai Organizations. Retrieved March 30, 2017.","url":"http://researchcenter.paloaltonetworks.com/2017/03/unit42-trochilus-rat-new-moonwind-rat-used-attack-thai-utility-organizations/"}]},{"id":"S0151","name":"HALFBAKED","url":"https://attack.mitre.org/software/S0151","kind":"malware","description":"[HALFBAKED](https://attack.mitre.org/software/S0151) can obtain information about running processes on the victim.(Citation: FireEye FIN7 April 2017)","relationship_id":"relationship--61fa303b-a9ff-419f-b3ac-96e43e37b6e5","references":[{"source_name":"FireEye FIN7 April 2017","description":"Carr, N., et al. (2017, April 24). FIN7 Evolution and the Phishing LNK. Retrieved April 24, 2017.","url":"https://www.fireeye.com/blog/threat-research/2017/04/fin7-phishing-lnk.html"}]},{"id":"S0154","name":"Cobalt Strike","url":"https://attack.mitre.org/software/S0154","kind":"malware","description":"[Cobalt Strike](https://attack.mitre.org/software/S0154)'s Beacon payload can collect information on process details.(Citation: cobaltstrike manual)(Citation: Talos Cobalt Strike September 2020)(Citation: Cobalt Strike Manual 4.3 November 2020)","relationship_id":"relationship--ecf30cb0-3183-4ed4-bb33-da604ea6a65e","references":[{"source_name":"Talos Cobalt Strike September 2020","description":"Mavis, N. (2020, September 21). The Art and Science of Detecting Cobalt Strike. Retrieved September 12, 2024.","url":"https://web.archive.org/web/20210219195905/https://talos-intelligence-site.s3.amazonaws.com/production/document_files/files/000/095/031/original/Talos_Cobalt_Strike.pdf"},{"source_name":"cobaltstrike manual","description":"Strategic Cyber LLC. (2017, March 14). Cobalt Strike Manual. Retrieved May 24, 2017.","url":"https://web.archive.org/web/20210825130434/https://cobaltstrike.com/downloads/csmanual38.pdf"},{"source_name":"Cobalt Strike Manual 4.3 November 2020","description":"Strategic Cyber LLC. (2020, November 5). Cobalt Strike: Advanced Threat Tactics for Penetration Testers. Retrieved April 13, 2021.","url":"https://web.archive.org/web/20210708035426/https://www.cobaltstrike.com/downloads/csmanual43.pdf"}]},{"id":"S0161","name":"XAgentOSX","url":"https://attack.mitre.org/software/S0161","kind":"malware","description":"[XAgentOSX](https://attack.mitre.org/software/S0161) contains the getProcessList function to run <code>ps aux</code> to get running processes.(Citation: XAgentOSX 2017)","relationship_id":"relationship--bb005145-438c-4fd8-9cac-a636df7465da","references":[{"source_name":"XAgentOSX 2017","description":"Robert Falcone. (2017, February 14). XAgentOSX: Sofacy's Xagent macOS Tool. Retrieved July 12, 2017.","url":"https://researchcenter.paloaltonetworks.com/2017/02/unit42-xagentosx-sofacys-xagent-macos-tool/"}]},{"id":"S0162","name":"Komplex","url":"https://attack.mitre.org/software/S0162","kind":"malware","description":"The OsInfo function in [Komplex](https://attack.mitre.org/software/S0162) collects a running process list.(Citation: Sofacy Komplex Trojan)","relationship_id":"relationship--9a62c02a-e373-494e-af73-f8b3274e8c9b","references":[{"source_name":"Sofacy Komplex Trojan","description":"Dani Creus, Tyler Halfpop, Robert Falcone. (2016, September 26). Sofacy's 'Komplex' OS X Trojan. Retrieved July 8, 2017.","url":"https://researchcenter.paloaltonetworks.com/2016/09/unit42-sofacys-komplex-os-x-trojan/"}]},{"id":"S0170","name":"Helminth","url":"https://attack.mitre.org/software/S0170","kind":"malware","description":"[Helminth](https://attack.mitre.org/software/S0170) has used [Tasklist](https://attack.mitre.org/software/S0057) to get information on processes.(Citation: Unit 42 Playbook Dec 2017)","relationship_id":"relationship--5bb90849-cdfe-4cc0-9ca3-128f17b2a1d1","references":[{"source_name":"Unit 42 Playbook Dec 2017","description":"Unit 42. (2017, December 15). Unit 42 Playbook Viewer. Retrieved December 20, 2017.","url":"https://web.archive.org/web/20230702043312/https://pan-unit42.github.io/playbook_viewer/"}]},{"id":"S0180","name":"Volgmer","url":"https://attack.mitre.org/software/S0180","kind":"malware","description":"[Volgmer](https://attack.mitre.org/software/S0180) can gather a list of processes.(Citation: Symantec Volgmer Aug 2014)","relationship_id":"relationship--83ea0666-2b0d-4db8-821c-e51c15335bd1","references":[{"source_name":"Symantec Volgmer Aug 2014","description":"Yagi, J. (2014, August 24). Trojan.Volgmer. Retrieved July 16, 2018.","url":"https://web.archive.org/web/20181126143456/https://www.symantec.com/security-center/writeup/2014-081811-3237-99?tabid=2"}]},{"id":"S0182","name":"FinFisher","url":"https://attack.mitre.org/software/S0182","kind":"malware","description":"[FinFisher](https://attack.mitre.org/software/S0182) checks its parent process for indications that it is running in a sandbox setup.(Citation: FinFisher Citation)(Citation: Microsoft FinFisher March 2018)","relationship_id":"relationship--d878a055-0053-45a9-a724-52f59e0486c7","references":[{"source_name":"Microsoft FinFisher March 2018","description":"Allievi, A.,Flori, E. (2018, March 01). FinFisher exposed: A researcher’s tale of defeating traps, tricks, and complex virtual machines. Retrieved July 9, 2018.","url":"https://cloudblogs.microsoft.com/microsoftsecure/2018/03/01/finfisher-exposed-a-researchers-tale-of-defeating-traps-tricks-and-complex-virtual-machines/"},{"source_name":"FinFisher Citation","description":"FinFisher. (n.d.). Retrieved September 12, 2024.","url":"https://web.archive.org/web/20171222050934/http://www.finfisher.com/FinFisher/index.html"}]},{"id":"S0184","name":"POWRUNER","url":"https://attack.mitre.org/software/S0184","kind":"malware","description":"[POWRUNER](https://attack.mitre.org/software/S0184) may collect process information by running <code>tasklist</code> on a victim.(Citation: FireEye APT34 Dec 2017)","relationship_id":"relationship--408db284-4c7a-4ad4-8399-90a8102b4bfa","references":[{"source_name":"FireEye APT34 Dec 2017","description":"Sardiwal, M, et al. (2017, December 7). New Targeted Attack in the Middle East by APT34, a Suspected Iranian Threat Group, Using CVE-2017-11882 Exploit. Retrieved December 20, 2017.","url":"https://www.fireeye.com/blog/threat-research/2017/12/targeted-attack-in-middle-east-by-apt34.html"}]},{"id":"S0192","name":"Pupy","url":"https://attack.mitre.org/software/S0192","kind":"tool","description":"[Pupy](https://attack.mitre.org/software/S0192) can list the running processes and get the process ID and parent process’s ID.(Citation: GitHub Pupy)","relationship_id":"relationship--fa2a7222-e9b1-4e97-82da-42a9c4014bdd","references":[{"source_name":"GitHub Pupy","description":"Nicolas Verdier. (n.d.). Retrieved January 29, 2018.","url":"https://github.com/n1nj4sec/pupy"}]},{"id":"S0194","name":"PowerSploit","url":"https://attack.mitre.org/software/S0194","kind":"tool","description":"[PowerSploit](https://attack.mitre.org/software/S0194)'s <code>Get-ProcessTokenPrivilege</code> Privesc-PowerUp module can enumerate privileges for a given process.(Citation: GitHub PowerSploit May 2012)(Citation: PowerSploit Documentation)","relationship_id":"relationship--c1cbaa0f-59d2-4b49-a91f-c21bff7ca009","references":[{"source_name":"GitHub PowerSploit May 2012","description":"PowerShellMafia. (2012, May 26). PowerSploit - A PowerShell Post-Exploitation Framework. Retrieved February 6, 2018.","url":"https://github.com/PowerShellMafia/PowerSploit"},{"source_name":"PowerSploit Documentation","description":"PowerSploit. (n.d.). PowerSploit. Retrieved February 6, 2018.","url":"http://powersploit.readthedocs.io"}]},{"id":"S0198","name":"NETWIRE","url":"https://attack.mitre.org/software/S0198","kind":"malware","description":"[NETWIRE](https://attack.mitre.org/software/S0198) can discover processes on compromised hosts.(Citation: FireEye NETWIRE March 2019)","relationship_id":"relationship--70346bf0-ce5e-46a0-8e0f-dd757afec050","references":[{"source_name":"FireEye NETWIRE March 2019","description":"Maniath, S. and Kadam P. (2019, March 19). Dissecting a NETWIRE Phishing Campaign's Usage of Process Hollowing. Retrieved January 7, 2021.","url":"https://www.mandiant.com/resources/blog/dissecting-netwire-phishing-campaigns-usage-process-hollowing"}]},{"id":"S0201","name":"JPIN","url":"https://attack.mitre.org/software/S0201","kind":"malware","description":"[JPIN](https://attack.mitre.org/software/S0201) can list running processes.(Citation: Microsoft PLATINUM April 2016)","relationship_id":"relationship--2738fdf5-b448-4c28-9918-dec89c31b2fc","references":[{"source_name":"Microsoft PLATINUM April 2016","description":"Windows Defender Advanced Threat Hunting Team. (2016, April 29). PLATINUM: Targeted attacks in South and Southeast Asia. Retrieved February 15, 2018.","url":"https://download.microsoft.com/download/2/2/5/225BFE3E-E1DE-4F5B-A77B-71200928D209/Platinum%20feature%20article%20-%20Targeted%20attacks%20in%20South%20and%20Southeast%20Asia%20April%202016.pdf"}]},{"id":"S0203","name":"Hydraq","url":"https://attack.mitre.org/software/S0203","kind":"malware","description":"[Hydraq](https://attack.mitre.org/software/S0203) creates a backdoor through which remote attackers can monitor processes.(Citation: Symantec Trojan.Hydraq Jan 2010)(Citation: Symantec Hydraq Jan 2010)","relationship_id":"relationship--a69bd4c0-ddaa-4dec-a35d-b067ae1d95fc","references":[{"source_name":"Symantec Trojan.Hydraq Jan 2010","description":"Symantec Security Response. (2010, January 18). The Trojan.Hydraq Incident. Retrieved February 20, 2018.","url":"https://www.symantec.com/connect/blogs/trojanhydraq-incident"},{"source_name":"Symantec Hydraq Jan 2010","description":"Lelli, A. (2010, January 11). Trojan.Hydraq. Retrieved February 20, 2018.","url":"https://www.symantec.com/security_response/writeup.jsp?docid=2010-011114-1830-99"}]},{"id":"S0208","name":"Pasam","url":"https://attack.mitre.org/software/S0208","kind":"malware","description":"[Pasam](https://attack.mitre.org/software/S0208) creates a backdoor through which remote attackers can retrieve lists of running processes.(Citation: Symantec Pasam May 2012)","relationship_id":"relationship--53a8ee3f-f261-46d5-a6eb-512735867ee2","references":[{"source_name":"Symantec Pasam May 2012","description":"Mullaney, C. & Honda, H. (2012, May 4). Trojan.Pasam. Retrieved February 22, 2018.","url":"https://www.symantec.com/security_response/writeup.jsp?docid=2012-050412-4128-99"}]},{"id":"S0211","name":"Linfo","url":"https://attack.mitre.org/software/S0211","kind":"malware","description":"[Linfo](https://attack.mitre.org/software/S0211) creates a backdoor through which remote attackers can retrieve a list of running processes.(Citation: Symantec Linfo May 2012)","relationship_id":"relationship--92e35558-f915-4357-b397-3cc7a0412b92","references":[{"source_name":"Symantec Linfo May 2012","description":"Zhou, R. (2012, May 15). Backdoor.Linfo. Retrieved February 23, 2018.","url":"https://www.symantec.com/security_response/writeup.jsp?docid=2012-051605-2535-99"}]},{"id":"S0216","name":"POORAIM","url":"https://attack.mitre.org/software/S0216","kind":"malware","description":"[POORAIM](https://attack.mitre.org/software/S0216) can enumerate processes.(Citation: FireEye APT37 Feb 2018)","relationship_id":"relationship--d2638428-d31e-4ea4-80e1-26c9c25472d6","references":[{"source_name":"FireEye APT37 Feb 2018","description":"FireEye. (2018, February 20). APT37 (Reaper): The Overlooked North Korean Actor. Retrieved November 17, 2024.","url":"https://services.google.com/fh/files/misc/apt37-reaper-the-overlooked-north-korean-actor.pdf"}]},{"id":"S0219","name":"WINERACK","url":"https://attack.mitre.org/software/S0219","kind":"malware","description":"[WINERACK](https://attack.mitre.org/software/S0219) can enumerate processes.(Citation: FireEye APT37 Feb 2018)","relationship_id":"relationship--149a056e-9061-4345-a46a-c1f73653d16a","references":[{"source_name":"FireEye APT37 Feb 2018","description":"FireEye. (2018, February 20). APT37 (Reaper): The Overlooked North Korean Actor. Retrieved November 17, 2024.","url":"https://services.google.com/fh/files/misc/apt37-reaper-the-overlooked-north-korean-actor.pdf"}]},{"id":"S0223","name":"POWERSTATS","url":"https://attack.mitre.org/software/S0223","kind":"malware","description":"[POWERSTATS](https://attack.mitre.org/software/S0223) has used <code>get_tasklist</code> to discover processes on the compromised host.(Citation: TrendMicro POWERSTATS V3 June 2019)","relationship_id":"relationship--ff3b4b17-7d3f-43a9-8e9a-ce56909da725","references":[{"source_name":"TrendMicro POWERSTATS V3 June 2019","description":"Lunghi, D. and Horejsi, J.. (2019, June 10). MuddyWater Resurfaces, Uses Multi-Stage Backdoor POWERSTATS V3 and New Post-Exploitation Tools. Retrieved May 14, 2020.","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/muddywater-resurfaces-uses-multi-stage-backdoor-powerstats-v3-and-new-post-exploitation-tools/"}]},{"id":"S0229","name":"Orz","url":"https://attack.mitre.org/software/S0229","kind":"malware","description":"[Orz](https://attack.mitre.org/software/S0229) can gather a process list from the victim.(Citation: Proofpoint Leviathan Oct 2017)","relationship_id":"relationship--1fbd687c-3e02-43b8-a160-4319a7d754ac","references":[{"source_name":"Proofpoint Leviathan Oct 2017","description":"Axel F, Pierre T. (2017, October 16). Leviathan: Espionage actor spearphishes maritime and defense targets. Retrieved February 15, 2018.","url":"https://www.proofpoint.com/us/threat-insight/post/leviathan-espionage-actor-spearphishes-maritime-and-defense-targets"}]},{"id":"S0236","name":"Kwampirs","url":"https://attack.mitre.org/software/S0236","kind":"malware","description":"[Kwampirs](https://attack.mitre.org/software/S0236) collects a list of running services with the command <code>tasklist /v</code>.(Citation: Symantec Orangeworm April 2018)","relationship_id":"relationship--c0f3f4f3-e435-443f-aa89-18afb0115055","references":[{"source_name":"Symantec Orangeworm April 2018","description":"Symantec Security Response Attack Investigation Team. (2018, April 23). New Orangeworm attack group targets the healthcare sector in the U.S., Europe, and Asia. Retrieved May 8, 2018.","url":"https://www.symantec.com/blogs/threat-intelligence/orangeworm-targets-healthcare-us-europe-asia"}]},{"id":"S0237","name":"GravityRAT","url":"https://attack.mitre.org/software/S0237","kind":"malware","description":"[GravityRAT](https://attack.mitre.org/software/S0237) lists the running processes on the system.(Citation: Talos GravityRAT)","relationship_id":"relationship--54ea458f-665e-42a3-b181-8d783e9589ad","references":[{"source_name":"Talos GravityRAT","description":"Mercer, W., Rascagneres, P. (2018, April 26). GravityRAT - The Two-Year Evolution Of An APT Targeting India. Retrieved May 16, 2018.","url":"https://blog.talosintelligence.com/2018/04/gravityrat-two-year-evolution-of-apt.html"}]},{"id":"S0238","name":"Proxysvc","url":"https://attack.mitre.org/software/S0238","kind":"malware","description":"[Proxysvc](https://attack.mitre.org/software/S0238) lists processes running on the system.(Citation: McAfee GhostSecret)","relationship_id":"relationship--c407e138-4e68-46e9-b41d-4447a282a1fd","references":[{"source_name":"McAfee GhostSecret","description":"Sherstobitoff, R., Malhotra, A. (2018, April 24). Analyzing Operation GhostSecret: Attack Seeks to Steal Data Worldwide. Retrieved May 16, 2018.","url":"https://securingtomorrow.mcafee.com/mcafee-labs/analyzing-operation-ghostsecret-attack-seeks-to-steal-data-worldwide/"}]},{"id":"S0239","name":"Bankshot","url":"https://attack.mitre.org/software/S0239","kind":"malware","description":"[Bankshot](https://attack.mitre.org/software/S0239) identifies processes and collects the process ids.(Citation: McAfee Bankshot)","relationship_id":"relationship--37ece881-96cf-441a-981d-ff3eeac292d7","references":[{"source_name":"McAfee Bankshot","description":"Sherstobitoff, R. (2018, March 08). Hidden Cobra Targets Turkish Financial Sector With New Bankshot Implant. Retrieved May 18, 2018.","url":"https://securingtomorrow.mcafee.com/mcafee-labs/hidden-cobra-targets-turkish-financial-sector-new-bankshot-implant/"}]},{"id":"S0240","name":"ROKRAT","url":"https://attack.mitre.org/software/S0240","kind":"malware","description":"[ROKRAT](https://attack.mitre.org/software/S0240) can list the current running processes on the system.(Citation: Talos ROKRAT)(Citation: NCCGroup RokRat Nov 2018)","relationship_id":"relationship--536ed2f4-46c5-4485-998c-60f0480d5c21","references":[{"source_name":"Talos ROKRAT","description":"Mercer, W., Rascagneres, P. (2017, April 03). Introducing ROKRAT. Retrieved May 21, 2018.","url":"https://blog.talosintelligence.com/2017/04/introducing-rokrat.html"},{"source_name":"NCCGroup RokRat Nov 2018","description":"Pantazopoulos, N.. (2018, November 8). RokRat Analysis. Retrieved May 21, 2020.","url":"https://research.nccgroup.com/2018/11/08/rokrat-analysis/"}]},{"id":"S0241","name":"RATANKBA","url":"https://attack.mitre.org/software/S0241","kind":"malware","description":"[RATANKBA](https://attack.mitre.org/software/S0241) lists the system’s processes.(Citation: Lazarus RATANKBA)(Citation: RATANKBA)","relationship_id":"relationship--87e7c117-bf53-432e-9ff3-2aeb2e522231","references":[{"source_name":"Lazarus RATANKBA","description":"Lei, C., et al. (2018, January 24). Lazarus Campaign Targeting Cryptocurrencies Reveals Remote Controller Tool, an Evolved RATANKBA, and More. Retrieved May 22, 2018.","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/lazarus-campaign-targeting-cryptocurrencies-reveals-remote-controller-tool-evolved-ratankba/"},{"source_name":"RATANKBA","description":"Trend Micro. (2017, February 27). RATANKBA: Delving into Large-scale Watering Holes against Enterprises. Retrieved May 22, 2018.","url":"https://www.trendmicro.com/en_us/research/17/b/ratankba-watering-holes-against-enterprises.html"}]},{"id":"S0242","name":"SynAck","url":"https://attack.mitre.org/software/S0242","kind":"malware","description":"[SynAck](https://attack.mitre.org/software/S0242) enumerates all running processes.(Citation: SecureList SynAck Doppelgänging May 2018)(Citation: Kaspersky Lab SynAck May 2018)","relationship_id":"relationship--da7fb67f-3cb2-498d-a832-f98622bc9ee2","references":[{"source_name":"SecureList SynAck Doppelgänging May 2018","description":"Ivanov, A. et al. (2018, May 7). SynAck targeted ransomware uses the Doppelgänging technique. Retrieved May 22, 2018.","url":"https://securelist.com/synack-targeted-ransomware-uses-the-doppelganging-technique/85431/"},{"source_name":"Kaspersky Lab SynAck May 2018","description":"Bettencourt, J. (2018, May 7). Kaspersky Lab finds new variant of SynAck ransomware using sophisticated Doppelgänging technique. Retrieved May 24, 2018.","url":"https://usa.kaspersky.com/about/press-releases/2018_synack-doppelganging"}]},{"id":"S0244","name":"Comnie","url":"https://attack.mitre.org/software/S0244","kind":"malware","description":"[Comnie](https://attack.mitre.org/software/S0244) uses the <code>tasklist</code> to view running processes on the victim’s machine.(Citation: Palo Alto Comnie)","relationship_id":"relationship--3c210990-7596-4773-a640-adf44490d08d","references":[{"source_name":"Palo Alto Comnie","description":"Grunzweig, J. (2018, January 31). Comnie Continues to Target Organizations in East Asia. Retrieved June 7, 2018.","url":"https://researchcenter.paloaltonetworks.com/2018/01/unit42-comnie-continues-target-organizations-east-asia/"}]},{"id":"S0247","name":"NavRAT","url":"https://attack.mitre.org/software/S0247","kind":"malware","description":"[NavRAT](https://attack.mitre.org/software/S0247) uses <code>tasklist /v</code> to check running processes.(Citation: Talos NavRAT May 2018)","relationship_id":"relationship--b9e42e0a-e779-4491-b107-a064254a7da3","references":[{"source_name":"Talos NavRAT May 2018","description":"Mercer, W., Rascagneres, P. (2018, May 31). NavRAT Uses US-North Korea Summit As Decoy For Attacks In South Korea. Retrieved June 11, 2018.","url":"https://blog.talosintelligence.com/2018/05/navrat.html"}]},{"id":"S0248","name":"yty","url":"https://attack.mitre.org/software/S0248","kind":"malware","description":"[yty](https://attack.mitre.org/software/S0248) gets an output of running processes using the <code>tasklist</code> command.(Citation: ASERT Donot March 2018)","relationship_id":"relationship--5caffa87-adbb-45e8-ba6b-dc61188471a7","references":[{"source_name":"ASERT Donot March 2018","description":"Schwarz, D., Sopko J. (2018, March 08). Donot Team Leverages New Modular Malware Framework in South Asia. Retrieved June 11, 2018.","url":"https://www.arbornetworks.com/blog/asert/donot-team-leverages-new-modular-malware-framework-south-asia/"}]},{"id":"S0249","name":"Gold Dragon","url":"https://attack.mitre.org/software/S0249","kind":"malware","description":"[Gold Dragon](https://attack.mitre.org/software/S0249) checks the running processes on the victim’s machine.(Citation: McAfee Gold Dragon)","relationship_id":"relationship--8481804a-2dc2-4e58-8515-1f3d1323f33e","references":[{"source_name":"McAfee Gold Dragon","description":"Sherstobitoff, R., Saavedra-Morales, J. (2018, February 02). Gold Dragon Widens Olympics Malware Attacks, Gains Permanent Presence on Victims’ Systems. Retrieved June 6, 2018.","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/gold-dragon-widens-olympics-malware-attacks-gains-permanent-presence-on-victims-systems/"}]},{"id":"S0251","name":"Zebrocy","url":"https://attack.mitre.org/software/S0251","kind":"malware","description":"[Zebrocy](https://attack.mitre.org/software/S0251) uses the <code>tasklist</code> and <code>wmic process get Capture, ExecutablePath</code> commands to gather the processes running on the system.(Citation: Unit42 Cannon Nov 2018)(Citation: ESET Zebrocy Nov 2018)(Citation: Unit42 Sofacy Dec 2018)(Citation: ESET Zebrocy May 2019)(Citation: Accenture SNAKEMACKEREL Nov 2018)","relationship_id":"relationship--1051f320-91fa-4f89-8abe-a851a56e18a7","references":[{"source_name":"Unit42 Cannon Nov 2018","description":"Falcone, R., Lee, B. (2018, November 20). Sofacy Continues Global Attacks and Wheels Out New ‘Cannon’ Trojan. Retrieved November 26, 2018.","url":"https://researchcenter.paloaltonetworks.com/2018/11/unit42-sofacy-continues-global-attacks-wheels-new-cannon-trojan/"},{"source_name":"ESET Zebrocy Nov 2018","description":"ESET. (2018, November 20). Sednit: What’s going on with Zebrocy?. Retrieved February 12, 2019.","url":"https://www.welivesecurity.com/2018/11/20/sednit-whats-going-zebrocy/"},{"source_name":"Unit42 Sofacy Dec 2018","description":"Lee, B., Falcone, R. (2018, December 12). Dear Joohn: The Sofacy Group’s Global Campaign. Retrieved April 19, 2019.","url":"https://unit42.paloaltonetworks.com/dear-joohn-sofacy-groups-global-campaign/"},{"source_name":"ESET Zebrocy May 2019","description":"ESET Research. (2019, May 22). A journey to Zebrocy land. Retrieved June 20, 2019.","url":"https://www.welivesecurity.com/2019/05/22/journey-zebrocy-land/"},{"source_name":"Accenture SNAKEMACKEREL Nov 2018","description":"Accenture Security. (2018, November 29). SNAKEMACKEREL. Retrieved April 15, 2019.","url":"https://www.accenture.com/t20181129T203820Z__w__/us-en/_acnmedia/PDF-90/Accenture-snakemackerel-delivers-zekapab-malware.pdf#zoom=50"}]},{"id":"S0252","name":"Brave Prince","url":"https://attack.mitre.org/software/S0252","kind":"malware","description":"[Brave Prince](https://attack.mitre.org/software/S0252) lists the running processes.(Citation: McAfee Gold Dragon)","relationship_id":"relationship--2d1beee9-0b61-4e66-9487-97f1665bbedc","references":[{"source_name":"McAfee Gold Dragon","description":"Sherstobitoff, R., Saavedra-Morales, J. (2018, February 02). Gold Dragon Widens Olympics Malware Attacks, Gains Permanent Presence on Victims’ Systems. Retrieved June 6, 2018.","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/gold-dragon-widens-olympics-malware-attacks-gains-permanent-presence-on-victims-systems/"}]},{"id":"S0254","name":"PLAINTEE","url":"https://attack.mitre.org/software/S0254","kind":"malware","description":"[PLAINTEE](https://attack.mitre.org/software/S0254) performs the <code>tasklist</code> command to list running processes.(Citation: Rancor Unit42 June 2018)","relationship_id":"relationship--91b6a6e1-c0eb-4bd8-84d4-4c31caf2ba6a","references":[{"source_name":"Rancor Unit42 June 2018","description":"Ash, B., et al. (2018, June 26). RANCOR: Targeted Attacks in South East Asia Using PLAINTEE and DDKONG Malware Families. Retrieved July 2, 2018.","url":"https://researchcenter.paloaltonetworks.com/2018/06/unit42-rancor-targeted-attacks-south-east-asia-using-plaintee-ddkong-malware-families/"}]},{"id":"S0256","name":"Mosquito","url":"https://attack.mitre.org/software/S0256","kind":"malware","description":"[Mosquito](https://attack.mitre.org/software/S0256) runs <code>tasklist</code> to obtain running processes.(Citation: ESET Turla Mosquito Jan 2018)","relationship_id":"relationship--9701df31-e2f4-487b-a204-26c4347ef32d","references":[{"source_name":"ESET Turla Mosquito Jan 2018","description":"ESET, et al. (2018, January). Diplomats in Eastern Europe bitten by a Turla mosquito. Retrieved July 3, 2018.","url":"https://www.welivesecurity.com/wp-content/uploads/2018/01/ESET_Turla_Mosquito.pdf"}]},{"id":"S0257","name":"VERMIN","url":"https://attack.mitre.org/software/S0257","kind":"malware","description":"[VERMIN](https://attack.mitre.org/software/S0257) can get a list of the processes and running tasks on the system.(Citation: Unit 42 VERMIN Jan 2018)","relationship_id":"relationship--f6247612-3255-44eb-860f-e882ee1f36f6","references":[{"source_name":"Unit 42 VERMIN Jan 2018","description":"Lancaster, T., Cortes, J. (2018, January 29). VERMIN: Quasar RAT and Custom Malware Used In Ukraine. Retrieved July 5, 2018.","url":"https://researchcenter.paloaltonetworks.com/2018/01/unit42-vermin-quasar-rat-custom-malware-used-ukraine/"}]},{"id":"S0260","name":"InvisiMole","url":"https://attack.mitre.org/software/S0260","kind":"malware","description":"[InvisiMole](https://attack.mitre.org/software/S0260) can obtain a list of running processes.(Citation: ESET InvisiMole June 2018)(Citation: ESET InvisiMole June 2020)","relationship_id":"relationship--eb1c808f-5806-4169-bd41-6ea7c7f17ffb","references":[{"source_name":"ESET InvisiMole June 2018","description":"Hromcová, Z. (2018, June 07). InvisiMole: Surprisingly equipped spyware, undercover since 2013. Retrieved July 10, 2018.","url":"https://www.welivesecurity.com/2018/06/07/invisimole-equipped-spyware-undercover/"},{"source_name":"ESET InvisiMole June 2020","description":"Hromcova, Z. and Cherpanov, A. (2020, June). INVISIMOLE: THE HIDDEN PART OF THE STORY. Retrieved July 16, 2020.","url":"https://www.welivesecurity.com/wp-content/uploads/2020/06/ESET_InvisiMole.pdf"}]},{"id":"S0265","name":"Kazuar","url":"https://attack.mitre.org/software/S0265","kind":"malware","description":"[Kazuar](https://attack.mitre.org/software/S0265) obtains a list of running processes through WMI querying and the <code>ps</code> command.(Citation: Unit 42 Kazuar May 2017)","relationship_id":"relationship--5e462e1b-62ec-4b44-990d-acd3f7b0010c","references":[{"source_name":"Unit 42 Kazuar May 2017","description":"Levene, B, et al. (2017, May 03). Kazuar: Multiplatform Espionage Backdoor with API Access. Retrieved July 17, 2018.","url":"https://researchcenter.paloaltonetworks.com/2017/05/unit42-kazuar-multiplatform-espionage-backdoor-api-access/"}]},{"id":"S0266","name":"TrickBot","url":"https://attack.mitre.org/software/S0266","kind":"malware","description":"[TrickBot](https://attack.mitre.org/software/S0266) uses module networkDll for process list discovery.(Citation: ESET Trickbot Oct 2020)(Citation: Bitdefender Trickbot March 2020)","relationship_id":"relationship--9af0d85e-688a-4dd7-a04e-a175e268855c","references":[{"source_name":"ESET Trickbot Oct 2020","description":"Boutin, J. (2020, October 12). ESET takes part in global operation to disrupt Trickbot. Retrieved March 15, 2021.","url":"https://www.welivesecurity.com/2020/10/12/eset-takes-part-global-operation-disrupt-trickbot/"},{"source_name":"Bitdefender Trickbot March 2020","description":"Tudorica, R., Maximciuc, A., Vatamanu, C. (2020, March 18). New TrickBot Module Bruteforces RDP Connections, Targets Select Telecommunication Services in US and Hong Kong. Retrieved March 15, 2021.","url":"https://www.bitdefender.com/files/News/CaseStudies/study/316/Bitdefender-Whitepaper-TrickBot-en-EN-interactive.pdf"}]},{"id":"S0267","name":"FELIXROOT","url":"https://attack.mitre.org/software/S0267","kind":"malware","description":"[FELIXROOT](https://attack.mitre.org/software/S0267) collects a list of running processes.(Citation: ESET GreyEnergy Oct 2018)","relationship_id":"relationship--058c67f3-9345-42be-a433-a4cea314d26d","references":[{"source_name":"ESET GreyEnergy Oct 2018","description":"Cherepanov, A. (2018, October). GREYENERGY A successor to BlackEnergy. Retrieved November 15, 2018.","url":"https://www.welivesecurity.com/wp-content/uploads/2018/10/ESET_GreyEnergy.pdf"}]},{"id":"S0268","name":"Bisonal","url":"https://attack.mitre.org/software/S0268","kind":"malware","description":"[Bisonal](https://attack.mitre.org/software/S0268) can obtain a list of running processes on the victim’s machine.(Citation: Unit 42 Bisonal July 2018)(Citation: Kaspersky CactusPete Aug 2020)(Citation: Talos Bisonal Mar 2020)","relationship_id":"relationship--1b03ba23-cbf3-4a77-8c8b-233a19e42a0c","references":[{"source_name":"Unit 42 Bisonal July 2018","description":"Hayashi, K., Ray, V. (2018, July 31). Bisonal Malware Used in Attacks Against Russia and South Korea. Retrieved August 7, 2018.","url":"https://researchcenter.paloaltonetworks.com/2018/07/unit42-bisonal-malware-used-attacks-russia-south-korea/"},{"source_name":"Kaspersky CactusPete Aug 2020","description":"Zykov, K. (2020, August 13). CactusPete APT group’s updated Bisonal backdoor. Retrieved May 5, 2021.","url":"https://securelist.com/cactuspete-apt-groups-updated-bisonal-backdoor/97962/"},{"source_name":"Talos Bisonal Mar 2020","description":"Mercer, W., et al. (2020, March 5). Bisonal: 10 years of play. Retrieved January 26, 2022.","url":"https://blog.talosintelligence.com/2020/03/bisonal-10-years-of-play.html"}]},{"id":"S0270","name":"RogueRobin","url":"https://attack.mitre.org/software/S0270","kind":"malware","description":"[RogueRobin](https://attack.mitre.org/software/S0270) checks the running processes for evidence it may be running in a sandbox environment. It specifically enumerates processes for Wireshark and Sysinternals.(Citation: Unit 42 DarkHydrus July 2018)","relationship_id":"relationship--c29136ea-6925-4fc5-a281-b5351cef050d","references":[{"source_name":"Unit 42 DarkHydrus July 2018","description":"Falcone, R., et al. (2018, July 27). New Threat Actor Group DarkHydrus Targets Middle East Government. Retrieved August 2, 2018.","url":"https://researchcenter.paloaltonetworks.com/2018/07/unit42-new-threat-actor-group-darkhydrus-targets-middle-east-government/"}]},{"id":"S0271","name":"KEYMARBLE","url":"https://attack.mitre.org/software/S0271","kind":"malware","description":"[KEYMARBLE](https://attack.mitre.org/software/S0271) can obtain a list of running processes on the system.(Citation: US-CERT KEYMARBLE Aug 2018)","relationship_id":"relationship--14639d10-6371-4e84-a637-a0e5846cb053","references":[{"source_name":"US-CERT KEYMARBLE Aug 2018","description":"US-CERT. (2018, August 09). MAR-10135536-17 – North Korean Trojan: KEYMARBLE. Retrieved August 16, 2018.","url":"https://www.us-cert.gov/ncas/analysis-reports/AR18-221A"}]},{"id":"S0273","name":"Socksbot","url":"https://attack.mitre.org/software/S0273","kind":"malware","description":"[Socksbot](https://attack.mitre.org/software/S0273) can list all running processes.(Citation: TrendMicro Patchwork Dec 2017)","relationship_id":"relationship--eb6ecbe4-07fc-4c45-9da8-fab737e300c3","references":[{"source_name":"TrendMicro Patchwork Dec 2017","description":"Lunghi, D., et al. (2017, December). Untangling the Patchwork Cyberespionage Group. Retrieved July 10, 2018.","url":"https://documents.trendmicro.com/assets/tech-brief-untangling-the-patchwork-cyberespionage-group.pdf"}]},{"id":"S0277","name":"FruitFly","url":"https://attack.mitre.org/software/S0277","kind":"malware","description":"[FruitFly](https://attack.mitre.org/software/S0277) has the ability to list processes on the system.(Citation: objsee mac malware 2017)","relationship_id":"relationship--112fec98-96be-4843-a56e-90d6b3fc02b2","references":[{"source_name":"objsee mac malware 2017","description":"Patrick Wardle. (n.d.). Mac Malware of 2017. Retrieved September 21, 2018.","url":"https://objective-see.com/blog/blog_0x25.html"}]},{"id":"S0278","name":"iKitten","url":"https://attack.mitre.org/software/S0278","kind":"malware","description":"[iKitten](https://attack.mitre.org/software/S0278) lists the current processes running.(Citation: objsee mac malware 2017)","relationship_id":"relationship--5647be4e-ef31-4b7d-a2d1-7feefafab345","references":[{"source_name":"objsee mac malware 2017","description":"Patrick Wardle. (n.d.). Mac Malware of 2017. Retrieved September 21, 2018.","url":"https://objective-see.com/blog/blog_0x25.html"}]},{"id":"S0283","name":"jRAT","url":"https://attack.mitre.org/software/S0283","kind":"malware","description":"[jRAT](https://attack.mitre.org/software/S0283) can query and kill system processes.(Citation: Symantec Frutas Feb 2013)","relationship_id":"relationship--7c1e2638-ca07-4825-b7e8-43690912ce74","references":[{"source_name":"Symantec Frutas Feb 2013","description":"Bingham, J. (2013, February 11). Cross-Platform Frutas RAT Builder and Back Door. Retrieved April 23, 2019.","url":"https://www.symantec.com/connect/blogs/cross-platform-frutas-rat-builder-and-back-door"}]},{"id":"S0330","name":"Zeus Panda","url":"https://attack.mitre.org/software/S0330","kind":"malware","description":"[Zeus Panda](https://attack.mitre.org/software/S0330) checks for running processes on the victim’s machine.(Citation: GDATA Zeus Panda June 2017)","relationship_id":"relationship--39f3e098-ca5d-4dc4-9cbb-bc29148def30","references":[{"source_name":"GDATA Zeus Panda June 2017","description":"Ebach, L. (2017, June 22). Analysis Results of Zeus.Variant.Panda. Retrieved November 5, 2018.","url":"https://cyberwtf.files.wordpress.com/2017/07/panda-whitepaper.pdf"}]},{"id":"S0331","name":"Agent Tesla","url":"https://attack.mitre.org/software/S0331","kind":"malware","description":"[Agent Tesla](https://attack.mitre.org/software/S0331) can list the current running processes on the system.(Citation: Fortinet Agent Tesla June 2017)","relationship_id":"relationship--431012d2-0ac4-49ba-b217-c118f0c1cf03","references":[{"source_name":"Fortinet Agent Tesla June 2017","description":"Zhang, X. (2017, June 28). In-Depth Analysis of A New Variant of .NET Malware AgentTesla. Retrieved November 5, 2018.","url":"https://www.fortinet.com/blog/threat-research/in-depth-analysis-of-net-malware-javaupdtr.html"}]},{"id":"S0332","name":"Remcos","url":"https://attack.mitre.org/software/S0332","kind":"tool","description":"[Remcos](https://attack.mitre.org/software/S0332) can discover running processes on compromised machines.(Citation: Fortinet Remcos Campaign NOV 2024)\n","relationship_id":"relationship--d45006be-8b4d-4eab-a76a-f940fecf83f9","references":[{"source_name":"Fortinet Remcos Campaign NOV 2024","description":"Zhang, X. (2024, November 8). New Campaign Uses Remcos RAT to Exploit Victims. Retrieved April 16, 2026.","url":"https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims"}]},{"id":"S0333","name":"UBoatRAT","url":"https://attack.mitre.org/software/S0333","kind":"malware","description":"[UBoatRAT](https://attack.mitre.org/software/S0333) can list running processes on the system.(Citation: PaloAlto UBoatRAT Nov 2017)","relationship_id":"relationship--e29fa4df-f835-48e1-a83b-279818993793","references":[{"source_name":"PaloAlto UBoatRAT Nov 2017","description":"Hayashi, K. (2017, November 28). UBoatRAT Navigates East Asia. Retrieved January 12, 2018.","url":"https://researchcenter.paloaltonetworks.com/2017/11/unit42-uboatrat-navigates-east-asia/"}]},{"id":"S0334","name":"DarkComet","url":"https://attack.mitre.org/software/S0334","kind":"malware","description":"[DarkComet](https://attack.mitre.org/software/S0334) can list active processes running on the victim’s machine.(Citation: Malwarebytes DarkComet March 2018)","relationship_id":"relationship--7c60bccc-f485-403d-ab3b-db861a3a4429","references":[{"source_name":"Malwarebytes DarkComet March 2018","description":"Kujawa, A. (2018, March 27). You dirty RAT! Part 1: DarkComet. Retrieved November 6, 2018.","url":"https://blog.malwarebytes.com/threat-analysis/2012/06/you-dirty-rat-part-1-darkcomet/"}]},{"id":"S0335","name":"Carbon","url":"https://attack.mitre.org/software/S0335","kind":"malware","description":"[Carbon](https://attack.mitre.org/software/S0335) can list the processes on the victim’s machine.(Citation: ESET Carbon Mar 2017)","relationship_id":"relationship--e6f2f304-e637-4636-a238-b30904ce11fc","references":[{"source_name":"ESET Carbon Mar 2017","description":"ESET. (2017, March 30). Carbon Paper: Peering into Turla’s second stage backdoor. Retrieved November 7, 2018.","url":"https://www.welivesecurity.com/2017/03/30/carbon-paper-peering-turlas-second-stage-backdoor/"}]},{"id":"S0344","name":"Azorult","url":"https://attack.mitre.org/software/S0344","kind":"malware","description":"[Azorult](https://attack.mitre.org/software/S0344) can collect a list of running processes by calling CreateToolhelp32Snapshot.(Citation: Unit42 Azorult Nov 2018)(Citation: Proofpoint Azorult July 2018)","relationship_id":"relationship--f503ea13-d045-4246-9674-a73f7e52ea85","references":[{"source_name":"Unit42 Azorult Nov 2018","description":"Yan, T., et al. (2018, November 21). New Wine in Old Bottle: New Azorult Variant Found in FindMyName Campaign using Fallout Exploit Kit. Retrieved November 29, 2018.","url":"https://researchcenter.paloaltonetworks.com/2018/11/unit42-new-wine-old-bottle-new-azorult-variant-found-findmyname-campaign-using-fallout-exploit-kit/"},{"source_name":"Proofpoint Azorult July 2018","description":"Proofpoint. (2018, July 30). New version of AZORult stealer improves loading features, spreads alongside ransomware in new campaign. Retrieved November 29, 2018.","url":"https://www.proofpoint.com/us/threat-insight/post/new-version-azorult-stealer-improves-loading-features-spreads-alongside"}]},{"id":"S0345","name":"Seasalt","url":"https://attack.mitre.org/software/S0345","kind":"malware","description":"[Seasalt](https://attack.mitre.org/software/S0345) has a command to perform a process listing.(Citation: Mandiant APT1 Appendix)","relationship_id":"relationship--4d36c850-0cd8-4e2a-9999-19f61eb37922","references":[{"source_name":"Mandiant APT1 Appendix","description":"Mandiant. (n.d.). Appendix C (Digital) - The Malware Arsenal. Retrieved July 18, 2016.","url":"https://www.mandiant.com/sites/default/files/2021-09/mandiant-apt1-report.pdf"}]},{"id":"S0346","name":"OceanSalt","url":"https://attack.mitre.org/software/S0346","kind":"malware","description":"[OceanSalt](https://attack.mitre.org/software/S0346) can collect the name and ID for every process running on the system.(Citation: McAfee Oceansalt Oct 2018)","relationship_id":"relationship--a3138e56-a496-486d-b11e-5e1c39a9c15d","references":[{"source_name":"McAfee Oceansalt Oct 2018","description":"Sherstobitoff, R., Malhotra, A. (2018, October 18). ‘Operation Oceansalt’ Attacks South Korea, U.S., and Canada With Source Code From Chinese Hacker Group. Retrieved November 30, 2018.","url":"https://www.mcafee.com/enterprise/en-us/assets/reports/rp-operation-oceansalt.pdf"}]},{"id":"S0348","name":"Cardinal RAT","url":"https://attack.mitre.org/software/S0348","kind":"malware","description":"[Cardinal RAT](https://attack.mitre.org/software/S0348) contains watchdog functionality that ensures its process is always running, else spawns a new instance.(Citation: PaloAlto CardinalRat Apr 2017)","relationship_id":"relationship--ed51de86-8e28-4436-a663-94b66f22a7df","references":[{"source_name":"PaloAlto CardinalRat Apr 2017","description":"Grunzweig, J.. (2017, April 20). Cardinal RAT Active for Over Two Years. Retrieved December 8, 2018.","url":"https://researchcenter.paloaltonetworks.com/2017/04/unit42-cardinal-rat-active-two-years/"}]},{"id":"S0351","name":"Cannon","url":"https://attack.mitre.org/software/S0351","kind":"malware","description":"[Cannon](https://attack.mitre.org/software/S0351) can obtain a list of processes running on the system.(Citation: Unit42 Cannon Nov 2018)(Citation: Unit42 Sofacy Dec 2018)","relationship_id":"relationship--11870221-f730-4844-a441-ac1e8d21bc4b","references":[{"source_name":"Unit42 Cannon Nov 2018","description":"Falcone, R., Lee, B. (2018, November 20). Sofacy Continues Global Attacks and Wheels Out New ‘Cannon’ Trojan. Retrieved November 26, 2018.","url":"https://researchcenter.paloaltonetworks.com/2018/11/unit42-sofacy-continues-global-attacks-wheels-new-cannon-trojan/"},{"source_name":"Unit42 Sofacy Dec 2018","description":"Lee, B., Falcone, R. (2018, December 12). Dear Joohn: The Sofacy Group’s Global Campaign. Retrieved April 19, 2019.","url":"https://unit42.paloaltonetworks.com/dear-joohn-sofacy-groups-global-campaign/"}]},{"id":"S0355","name":"Final1stspy","url":"https://attack.mitre.org/software/S0355","kind":"malware","description":"[Final1stspy](https://attack.mitre.org/software/S0355) obtains a list of running processes.(Citation: Unit 42 Nokki Oct 2018)","relationship_id":"relationship--4322dad3-453f-4af5-bd1c-0099baaf2b61","references":[{"source_name":"Unit 42 Nokki Oct 2018","description":"Grunzweig, J. (2018, October 01). NOKKI Almost Ties the Knot with DOGCALL: Reaper Group Uses New Malware to Deploy RAT. Retrieved November 5, 2018.","url":"https://researchcenter.paloaltonetworks.com/2018/10/unit42-nokki-almost-ties-the-knot-with-dogcall-reaper-group-uses-new-malware-to-deploy-rat/"}]},{"id":"S0356","name":"KONNI","url":"https://attack.mitre.org/software/S0356","kind":"malware","description":"[KONNI](https://attack.mitre.org/software/S0356) has used the command <code>cmd /c tasklist</code> to get a snapshot of the current processes on the target machine.(Citation: Medium KONNI Jan 2020)(Citation: Malwarebytes Konni Aug 2021)","relationship_id":"relationship--726cd7e2-d545-4ddf-8f86-fe1cab083dae","references":[{"source_name":"Medium KONNI Jan 2020","description":"Karmi, D. (2020, January 4). A Look Into Konni 2019 Campaign. Retrieved April 28, 2020.","url":"https://medium.com/d-hunter/a-look-into-konni-2019-campaign-b45a0f321e9b"},{"source_name":"Malwarebytes Konni Aug 2021","description":"Threat Intelligence Team. (2021, August 23). New variant of Konni malware used in campaign targetting Russia. Retrieved January 5, 2022.","url":"https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/"}]},{"id":"S0363","name":"Empire","url":"https://attack.mitre.org/software/S0363","kind":"tool","description":"[Empire](https://attack.mitre.org/software/S0363) can find information about processes running on local and remote systems.(Citation: Github PowerShell Empire)(Citation: Talos Frankenstein June 2019)","relationship_id":"relationship--ee565652-51c8-4fe8-bb05-682c6942485a","references":[{"source_name":"Talos Frankenstein June 2019","description":"Adamitis, D. et al. (2019, June 4). It's alive: Threat actors cobble together open-source pieces into monstrous Frankenstein campaign. Retrieved May 11, 2020.","url":"https://blog.talosintelligence.com/2019/06/frankenstein-campaign.html"},{"source_name":"Github PowerShell Empire","description":"Schroeder, W., Warner, J., Nelson, M. (n.d.). Github PowerShellEmpire. Retrieved April 28, 2016.","url":"https://github.com/PowerShellEmpire/Empire"}]},{"id":"S0367","name":"Emotet","url":"https://attack.mitre.org/software/S0367","kind":"malware","description":"[Emotet](https://attack.mitre.org/software/S0367) has been observed enumerating local processes.(Citation: ASEC Emotet 2017)","relationship_id":"relationship--e39eb7ad-f233-4c22-8707-aaf600f42100","references":[{"source_name":"ASEC Emotet 2017","description":"ASEC. (2017). ASEC REPORT VOL.88. Retrieved April 16, 2019.","url":"https://global.ahnlab.com/global/upload/download/asecreport/ASEC%20REPORT_vol.88_ENG.pdf"}]},{"id":"S0373","name":"Astaroth","url":"https://attack.mitre.org/software/S0373","kind":"malware","description":"[Astaroth](https://attack.mitre.org/software/S0373) searches for different processes on the system.(Citation: Cybereason Astaroth Feb 2019)","relationship_id":"relationship--366bf114-ddd3-473a-9468-c82811c6ed70","references":[{"source_name":"Cybereason Astaroth Feb 2019","description":"Salem, E. (2019, February 13). ASTAROTH MALWARE USES LEGITIMATE OS AND ANTIVIRUS PROCESSES TO STEAL PASSWORDS AND PERSONAL DATA. Retrieved April 17, 2019.","url":"https://www.cybereason.com/blog/information-stealing-malware-targeting-brazil-full-research"}]},{"id":"S0385","name":"njRAT","url":"https://attack.mitre.org/software/S0385","kind":"malware","description":"[njRAT](https://attack.mitre.org/software/S0385) can search a list of running processes for Tr.exe.(Citation: Trend Micro njRAT 2018)","relationship_id":"relationship--d46078a7-420b-4074-8ecb-3440737c12e4","references":[{"source_name":"Trend Micro njRAT 2018","description":"Pascual, C. (2018, November 27). AutoIt-Compiled Worm Affecting Removable Media Delivers Fileless Version of BLADABINDI/njRAT Backdoor. Retrieved June 4, 2019.","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/autoit-compiled-worm-affecting-removable-media-delivers-fileless-version-of-bladabindi-njrat-backdoor/"}]},{"id":"S0386","name":"Ursnif","url":"https://attack.mitre.org/software/S0386","kind":"malware","description":"[Ursnif](https://attack.mitre.org/software/S0386) has gathered information about running processes.(Citation: TrendMicro Ursnif Mar 2015)(Citation: TrendMicro BKDR_URSNIF.SM)","relationship_id":"relationship--416447f0-410b-46d6-a4f8-e67ba3c9052f","references":[{"source_name":"TrendMicro Ursnif Mar 2015","description":"Caragay, R. (2015, March 26). URSNIF: The Multifaceted Malware. Retrieved June 5, 2019.","url":"https://web.archive.org/web/20210719165945/https://www.trendmicro.com/en_us/research/15/c/ursnif-the-multifaceted-malware.html?_ga=2.165628854.808042651.1508120821-744063452.1505819992"},{"source_name":"TrendMicro BKDR_URSNIF.SM","description":"Sioting, S. (2013, June 15). BKDR_URSNIF.SM. Retrieved June 5, 2019.","url":"https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/BKDR_URSNIF.SM?_ga=2.129468940.1462021705.1559742358-1202584019.1549394279"}]},{"id":"S0393","name":"PowerStallion","url":"https://attack.mitre.org/software/S0393","kind":"malware","description":"[PowerStallion](https://attack.mitre.org/software/S0393) has been used to monitor process lists.(Citation: ESET Turla PowerShell May 2019)","relationship_id":"relationship--772089d3-b06e-4e5e-993b-1351f71484e7","references":[{"source_name":"ESET Turla PowerShell May 2019","description":"Faou, M. and Dumont R.. (2019, May 29). A dive into Turla PowerShell usage. Retrieved June 14, 2019.","url":"https://www.welivesecurity.com/2019/05/29/turla-powershell-usage/"}]},{"id":"S0396","name":"EvilBunny","url":"https://attack.mitre.org/software/S0396","kind":"malware","description":"[EvilBunny](https://attack.mitre.org/software/S0396) has used EnumProcesses() to identify how many process are running in the environment.(Citation: Cyphort EvilBunny Dec 2014)","relationship_id":"relationship--e2753d61-40d9-45b3-884a-a4c63b1da476","references":[{"source_name":"Cyphort EvilBunny Dec 2014","description":"Marschalek, M.. (2014, December 16). EvilBunny: Malware Instrumented By Lua. Retrieved June 28, 2019.","url":"https://web.archive.org/web/20150311013500/http://www.cyphort.com/evilbunny-malware-instrumented-lua/"}]},{"id":"S0409","name":"Machete","url":"https://attack.mitre.org/software/S0409","kind":"malware","description":"[Machete](https://attack.mitre.org/software/S0409) has a component to check for running processes to look for web browsers.(Citation: ESET Machete July 2019) ","relationship_id":"relationship--268d6aed-3961-42d9-9d34-785a9903d004","references":[{"source_name":"ESET Machete July 2019","description":"ESET. (2019, July). MACHETE JUST GOT SHARPER Venezuelan government institutions under attack. Retrieved September 13, 2019.","url":"https://www.welivesecurity.com/wp-content/uploads/2019/08/ESET_Machete.pdf"}]},{"id":"S0410","name":"Fysbis","url":"https://attack.mitre.org/software/S0410","kind":"malware","description":"[Fysbis](https://attack.mitre.org/software/S0410) can collect information about running processes.(Citation: Fysbis Dr Web Analysis) ","relationship_id":"relationship--3029d06e-7a13-4d17-bad5-ce3198bce2ef","references":[{"source_name":"Fysbis Dr Web Analysis","description":"Doctor Web. (2014, November 21). Linux.BackDoor.Fysbis.1. Retrieved December 7, 2017.","url":"https://vms.drweb.com/virus/?i=4276269"}]},{"id":"S0412","name":"ZxShell","url":"https://attack.mitre.org/software/S0412","kind":"malware","description":"[ZxShell](https://attack.mitre.org/software/S0412) has a command, ps, to obtain a listing of processes on the system.(Citation: Talos ZxShell Oct 2014) ","relationship_id":"relationship--68d151ea-6dd8-4e6b-acd5-c998ebffc357","references":[{"source_name":"Talos ZxShell Oct 2014","description":"Allievi, A., et al. (2014, October 28). Threat Spotlight: Group 72, Opening the ZxShell. Retrieved September 24, 2019.","url":"https://blogs.cisco.com/security/talos/opening-zxshell"}]},{"id":"S0414","name":"BabyShark","url":"https://attack.mitre.org/software/S0414","kind":"malware","description":"[BabyShark](https://attack.mitre.org/software/S0414) has executed the <code>tasklist</code> command.(Citation: Unit42 BabyShark Feb 2019)\t","relationship_id":"relationship--54a384e5-17c8-422d-b199-18e7945cb7d6","references":[{"source_name":"Unit42 BabyShark Feb 2019","description":"Unit 42. (2019, February 22). New BabyShark Malware Targets U.S. National Security Think Tanks. Retrieved October 7, 2019.","url":"https://unit42.paloaltonetworks.com/new-babyshark-malware-targets-u-s-national-security-think-tanks/"}]},{"id":"S0428","name":"PoetRAT","url":"https://attack.mitre.org/software/S0428","kind":"malware","description":"[PoetRAT](https://attack.mitre.org/software/S0428) has the ability to list all running processes.(Citation: Talos PoetRAT April 2020)","relationship_id":"relationship--ab2602d5-a3f5-45d2-a522-9b4f87bc7a24","references":[{"source_name":"Talos PoetRAT April 2020","description":"Mercer, W, et al. (2020, April 16). PoetRAT: Python RAT uses COVID-19 lures to target Azerbaijan public and private sectors. Retrieved April 27, 2020.","url":"https://blog.talosintelligence.com/2020/04/poetrat-covid-19-lures.html"}]},{"id":"S0431","name":"HotCroissant","url":"https://attack.mitre.org/software/S0431","kind":"malware","description":"[HotCroissant](https://attack.mitre.org/software/S0431) has the ability to list running processes on the infected host.(Citation: Carbon Black HotCroissant April 2020)","relationship_id":"relationship--a5720510-fadb-496d-97b5-99cdabb051ab","references":[{"source_name":"Carbon Black HotCroissant April 2020","description":"Knight, S.. (2020, April 16). VMware Carbon Black TAU Threat Analysis: The Evolution of Lazarus. Retrieved May 1, 2020.","url":"https://www.carbonblack.com/2020/04/16/vmware-carbon-black-tau-threat-analysis-the-evolution-of-lazarus/"}]},{"id":"S0434","name":"Imminent Monitor","url":"https://attack.mitre.org/software/S0434","kind":"tool","description":"[Imminent Monitor](https://attack.mitre.org/software/S0434) has a \"Process Watcher\" feature to monitor processes in case the client ever crashes or gets closed.(Citation: Imminent Unit42 Dec2019)","relationship_id":"relationship--4458ca35-0285-408b-9059-62c36086fd0a","references":[{"source_name":"Imminent Unit42 Dec2019","description":"Unit 42. (2019, December 2). Imminent Monitor – a RAT Down Under. Retrieved May 5, 2020.","url":"https://unit42.paloaltonetworks.com/imminent-monitor-a-rat-down-under/"}]},{"id":"S0435","name":"PLEAD","url":"https://attack.mitre.org/software/S0435","kind":"malware","description":"[PLEAD](https://attack.mitre.org/software/S0435) has the ability to list processes on the compromised host.(Citation: TrendMicro BlackTech June 2017)","relationship_id":"relationship--dd4da2e6-a54b-4420-9ed6-ebb3080bd2f8","references":[{"source_name":"TrendMicro BlackTech June 2017","description":"Bermejo, L., et al. (2017, June 22). Following the Trail of BlackTech’s Cyber Espionage Campaigns. Retrieved May 5, 2020.","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/following-trail-blacktech-cyber-espionage-campaigns/"}]},{"id":"S0436","name":"TSCookie","url":"https://attack.mitre.org/software/S0436","kind":"malware","description":"[TSCookie](https://attack.mitre.org/software/S0436) has the ability to list processes on the infected host.(Citation: JPCert TSCookie March 2018)","relationship_id":"relationship--1cc625dd-3079-4aa5-99f5-db1897795500","references":[{"source_name":"JPCert TSCookie March 2018","description":"Tomonaga, S. (2018, March 6). Malware “TSCookie”. Retrieved May 6, 2020.","url":"https://blogs.jpcert.or.jp/en/2018/03/malware-tscooki-7aa0.html"}]},{"id":"S0441","name":"PowerShower","url":"https://attack.mitre.org/software/S0441","kind":"malware","description":"[PowerShower](https://attack.mitre.org/software/S0441) has the ability to deploy a reconnaissance module to retrieve a list of the active processes.(Citation: Kaspersky Cloud Atlas August 2019)","relationship_id":"relationship--45098d46-2345-4fe4-8b07-2345ffbb9e60","references":[{"source_name":"Kaspersky Cloud Atlas August 2019","description":"GReAT. (2019, August 12). Recent Cloud Atlas activity. Retrieved May 8, 2020.","url":"https://securelist.com/recent-cloud-atlas-activity/92016/"}]},{"id":"S0445","name":"ShimRatReporter","url":"https://attack.mitre.org/software/S0445","kind":"tool","description":"[ShimRatReporter](https://attack.mitre.org/software/S0445) listed all running processes on the machine.(Citation: FOX-IT May 2016 Mofang)","relationship_id":"relationship--f6ac9b3a-9a1f-40be-b541-bcdb8aac6845","references":[{"source_name":"FOX-IT May 2016 Mofang","description":"Yonathan Klijnsma. (2016, May 17). Mofang: A politically motivated information stealing adversary. Retrieved May 12, 2020.","url":"https://foxitsecurity.files.wordpress.com/2016/06/fox-it_mofang_threatreport_tlp-white.pdf"}]},{"id":"S0446","name":"Ryuk","url":"https://attack.mitre.org/software/S0446","kind":"malware","description":"[Ryuk](https://attack.mitre.org/software/S0446) has called <code>CreateToolhelp32Snapshot</code> to enumerate all running processes.(Citation: CrowdStrike Ryuk January 2019)","relationship_id":"relationship--18d29bb2-655b-4e3d-9759-32a74be3eb75","references":[{"source_name":"CrowdStrike Ryuk January 2019","description":"Hanel, A. (2019, January 10). Big Game Hunting with Ryuk: Another Lucrative Targeted Ransomware. Retrieved May 12, 2020.","url":"https://www.crowdstrike.com/blog/big-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/"}]},{"id":"S0448","name":"Rising Sun","url":"https://attack.mitre.org/software/S0448","kind":"malware","description":"[Rising Sun](https://attack.mitre.org/software/S0448) can enumerate all running processes and process information on an infected machine.(Citation: McAfee Sharpshooter December 2018)\t","relationship_id":"relationship--8a7317fd-fa8f-4c32-8aa5-4ff225116f7e","references":[{"source_name":"McAfee Sharpshooter December 2018","description":"Sherstobitoff, R., Malhotra, A., et. al.. (2018, December 18). Operation Sharpshooter Campaign Targets Global Defense, Critical Infrastructure. Retrieved May 14, 2020.","url":"https://www.mcafee.com/enterprise/en-us/assets/reports/rp-operation-sharpshooter.pdf"}]},{"id":"S0449","name":"Maze","url":"https://attack.mitre.org/software/S0449","kind":"malware","description":"[Maze](https://attack.mitre.org/software/S0449) has gathered all of the running system processes.(Citation: McAfee Maze March 2020)\t","relationship_id":"relationship--c54e60c1-728d-4211-b309-89f928ae7f0a","references":[{"source_name":"McAfee Maze March 2020","description":"Mundo, A. (2020, March 26). Ransomware Maze. Retrieved May 18, 2020.","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/ransomware-maze/"}]},{"id":"S0451","name":"LoudMiner","url":"https://attack.mitre.org/software/S0451","kind":"malware","description":"[LoudMiner](https://attack.mitre.org/software/S0451) used the <code>ps</code> command to monitor the running processes on the system.(Citation: ESET LoudMiner June 2019)\t","relationship_id":"relationship--1232c797-ebf4-4036-9ebb-a65fbe8b1443","references":[{"source_name":"ESET LoudMiner June 2019","description":"Malik, M. (2019, June 20). LoudMiner: Cross-platform mining in cracked VST software. Retrieved May 18, 2020.","url":"https://www.welivesecurity.com/2019/06/20/loudminer-mining-cracked-vst-software/"}]},{"id":"S0452","name":"USBferry","url":"https://attack.mitre.org/software/S0452","kind":"malware","description":"[USBferry](https://attack.mitre.org/software/S0452) can use <code>tasklist</code> to gather information about the process running on the infected system.(Citation: TrendMicro Tropic Trooper May 2020)\t","relationship_id":"relationship--bfad86a1-f8bb-45eb-b7b9-5919ca4ef886","references":[{"source_name":"TrendMicro Tropic Trooper May 2020","description":"Chen, J.. (2020, May 12). Tropic Trooper’s Back: USBferry Attack Targets Air gapped Environments. Retrieved May 20, 2020.","url":"https://documents.trendmicro.com/assets/Tech-Brief-Tropic-Trooper-s-Back-USBferry-Attack-Targets-Air-gapped-Environments.pdf"}]},{"id":"S0455","name":"Metamorfo","url":"https://attack.mitre.org/software/S0455","kind":"malware","description":"[Metamorfo](https://attack.mitre.org/software/S0455) has performed process name checks and has monitored applications.(Citation: Medium Metamorfo Apr 2020) ","relationship_id":"relationship--eac61f60-a87d-4f83-b5e0-64542efeca6b","references":[{"source_name":"Medium Metamorfo Apr 2020","description":"Erlich, C. (2020, April 3). The Avast Abuser: Metamorfo Banking Malware Hides By Abusing Avast Executable. Retrieved May 26, 2020.","url":"https://medium.com/@chenerlich/the-avast-abuser-metamorfo-banking-malware-hides-by-abusing-avast-executable-ac9b8b392767"}]},{"id":"S0456","name":"Aria-body","url":"https://attack.mitre.org/software/S0456","kind":"malware","description":"[Aria-body](https://attack.mitre.org/software/S0456) has the ability to enumerate loaded modules for a process.(Citation: CheckPoint Naikon May 2020).","relationship_id":"relationship--0ed0ef18-126f-4a03-ac2a-f315dfb48b7d","references":[{"source_name":"CheckPoint Naikon May 2020","description":"CheckPoint. (2020, May 7). Naikon APT: Cyber Espionage Reloaded. Retrieved May 26, 2020.","url":"https://research.checkpoint.com/2020/naikon-apt-cyber-espionage-reloaded/"}]},{"id":"S0458","name":"Ramsay","url":"https://attack.mitre.org/software/S0458","kind":"malware","description":"[Ramsay](https://attack.mitre.org/software/S0458) can gather a list of running processes by using [Tasklist](https://attack.mitre.org/software/S0057).(Citation: Antiy CERT Ramsay April 2020)","relationship_id":"relationship--8d5a8f57-0d67-462f-a4f5-7fc4268e4ab2","references":[{"source_name":"Antiy CERT Ramsay April 2020","description":"Antiy CERT. (2020, April 20). Analysis of Ramsay components of Darkhotel's infiltration and isolation network. Retrieved March 24, 2021.","url":"https://www.programmersought.com/article/62493896999/"}]},{"id":"S0460","name":"Get2","url":"https://attack.mitre.org/software/S0460","kind":"malware","description":"[Get2](https://attack.mitre.org/software/S0460) has the ability to identify running processes on an infected host.(Citation: Proofpoint TA505 October 2019)","relationship_id":"relationship--6118a138-c13c-4117-97dd-c3e7ec3e1021","references":[{"source_name":"Proofpoint TA505 October 2019","description":"Schwarz, D. et al. (2019, October 16). TA505 Distributes New SDBbot Remote Access Trojan with Get2 Downloader. Retrieved May 29, 2020.","url":"https://www.proofpoint.com/us/threat-insight/post/ta505-distributes-new-sdbbot-remote-access-trojan-get2-downloader"}]},{"id":"S0461","name":"SDBbot","url":"https://attack.mitre.org/software/S0461","kind":"malware","description":"[SDBbot](https://attack.mitre.org/software/S0461) can enumerate a list of running processes on a compromised machine.(Citation: Korean FSI TA505 2020)","relationship_id":"relationship--d0c15113-67a0-4f02-8a92-d22165642d40","references":[{"source_name":"Korean FSI TA505 2020","description":"Financial Security Institute. (2020, February 28). Profiling of TA505 Threat Group That Continues to Attack the Financial Sector. Retrieved July 14, 2022.","url":"https://www.fsec.or.kr/user/bbs/fsec/163/344/bbsDataView/1382.do?page=1&column=&search=&searchSDate=&searchEDate=&bbsDataCategory="}]},{"id":"S0464","name":"SYSCON","url":"https://attack.mitre.org/software/S0464","kind":"malware","description":"[SYSCON](https://attack.mitre.org/software/S0464) has the ability to use [Tasklist](https://attack.mitre.org/software/S0057) to list running processes.(Citation: Unit 42 CARROTBAT January 2020)","relationship_id":"relationship--b5744487-e865-4ff2-9d69-e98c1148aade","references":[{"source_name":"Unit 42 CARROTBAT January 2020","description":"McCabe, A. (2020, January 23). The Fractured Statue Campaign: U.S. Government Agency Targeted in Spear-Phishing Attacks. Retrieved June 2, 2020.","url":"https://unit42.paloaltonetworks.com/the-fractured-statue-campaign-u-s-government-targeted-in-spear-phishing-attacks/"}]},{"id":"S0467","name":"TajMahal","url":"https://attack.mitre.org/software/S0467","kind":"malware","description":"[TajMahal](https://attack.mitre.org/software/S0467) has the ability to identify running processes and associated plugins on an infected host.(Citation: Kaspersky TajMahal April 2019)","relationship_id":"relationship--7f31ac80-5e21-4449-8bb3-9c2ad943dc08","references":[{"source_name":"Kaspersky TajMahal April 2019","description":"GReAT. (2019, April 10). Project TajMahal – a sophisticated new APT framework. Retrieved October 14, 2019.","url":"https://securelist.com/project-tajmahal/90240/"}]},{"id":"S0468","name":"Skidmap","url":"https://attack.mitre.org/software/S0468","kind":"malware","description":"[Skidmap](https://attack.mitre.org/software/S0468) has monitored critical processes to ensure resiliency.(Citation: Trend Micro Skidmap) ","relationship_id":"relationship--8ca0a20d-2c12-4b68-a2a9-ebd95c05ee68","references":[{"source_name":"Trend Micro Skidmap","description":"Remillano, A., Urbanec, J. (2019, September 19). Skidmap Linux Malware Uses Rootkit Capabilities to Hide Cryptocurrency-Mining Payload. Retrieved June 4, 2020.","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/skidmap-linux-malware-uses-rootkit-capabilities-to-hide-cryptocurrency-mining-payload/"}]},{"id":"S0472","name":"down_new","url":"https://attack.mitre.org/software/S0472","kind":"malware","description":"[down_new](https://attack.mitre.org/software/S0472) has the ability to list running processes on a compromised host.(Citation: Trend Micro Tick November 2019)","relationship_id":"relationship--56e4717c-33ac-4d7e-a737-71aa520af93e","references":[{"source_name":"Trend Micro Tick November 2019","description":"Chen, J. et al. (2019, November). Operation ENDTRADE: TICK’s Multi-Stage Backdoors for Attacking Industries and Stealing Classified Data. Retrieved June 9, 2020.","url":"https://documents.trendmicro.com/assets/pdf/Operation-ENDTRADE-TICK-s-Multi-Stage-Backdoors-for-Attacking-Industries-and-Stealing-Classified-Data.pdf"}]},{"id":"S0473","name":"Avenger","url":"https://attack.mitre.org/software/S0473","kind":"malware","description":"[Avenger](https://attack.mitre.org/software/S0473) has the ability to use [Tasklist](https://attack.mitre.org/software/S0057) to identify running processes.(Citation: Trend Micro Tick November 2019)","relationship_id":"relationship--4a5d8511-633c-4429-ac64-37a4815bf545","references":[{"source_name":"Trend Micro Tick November 2019","description":"Chen, J. et al. (2019, November). Operation ENDTRADE: TICK’s Multi-Stage Backdoors for Attacking Industries and Stealing Classified Data. Retrieved June 9, 2020.","url":"https://documents.trendmicro.com/assets/pdf/Operation-ENDTRADE-TICK-s-Multi-Stage-Backdoors-for-Attacking-Industries-and-Stealing-Classified-Data.pdf"}]},{"id":"S0476","name":"Valak","url":"https://attack.mitre.org/software/S0476","kind":"malware","description":"[Valak](https://attack.mitre.org/software/S0476) has the ability to enumerate running processes on a compromised host.(Citation: Cybereason Valak May 2020)","relationship_id":"relationship--1ca28941-562d-45e4-946c-518a2015c0dd","references":[{"source_name":"Cybereason Valak May 2020","description":"Salem, E. et al. (2020, May 28). VALAK: MORE THAN MEETS THE EYE . Retrieved June 19, 2020.","url":"https://www.cybereason.com/blog/valak-more-than-meets-the-eye"}]},{"id":"S0477","name":"Goopy","url":"https://attack.mitre.org/software/S0477","kind":"malware","description":"[Goopy](https://attack.mitre.org/software/S0477) has checked for the Google Updater process to ensure [Goopy](https://attack.mitre.org/software/S0477) was loaded properly.(Citation: Cybereason Cobalt Kitty 2017)","relationship_id":"relationship--afffac16-cc57-4b01-8325-d88ab73454e1","references":[{"source_name":"Cybereason Cobalt Kitty 2017","description":"Dahan, A. (2017). Operation Cobalt Kitty. Retrieved December 27, 2018.","url":"https://cdn2.hubspot.net/hubfs/3354902/Cybereason%20Labs%20Analysis%20Operation%20Cobalt%20Kitty.pdf"}]},{"id":"S0482","name":"Bundlore","url":"https://attack.mitre.org/software/S0482","kind":"malware","description":"[Bundlore](https://attack.mitre.org/software/S0482) has used the <code>ps</code> command to list processes.(Citation: MacKeeper Bundlore Apr 2019)","relationship_id":"relationship--1e10af38-1695-45ab-8db2-8cd476a58a45","references":[{"source_name":"MacKeeper Bundlore Apr 2019","description":"Sushko, O. (2019, April 17). macOS Bundlore: Mac Virus Bypassing macOS Security Features. Retrieved June 30, 2020.","url":"https://mackeeper.com/blog/post/610-macos-bundlore-adware-analysis/"}]},{"id":"S0484","name":"Carberp","url":"https://attack.mitre.org/software/S0484","kind":"malware","description":"[Carberp](https://attack.mitre.org/software/S0484) has collected a list of running processes.(Citation: Trusteer Carberp October 2010)","relationship_id":"relationship--f83167c8-b964-44d2-b370-5f5e86460568","references":[{"source_name":"Trusteer Carberp October 2010","description":"Trusteer Fraud Prevention Center. (2010, October 7). Carberp Under the Hood of Carberp: Malware & Configuration Analysis. Retrieved July 15, 2020.","url":"https://web.archive.org/web/20111004014029/http://www.trusteer.com/sites/default/files/Carberp_Analysis.pdf"}]},{"id":"S0486","name":"Bonadan","url":"https://attack.mitre.org/software/S0486","kind":"malware","description":"[Bonadan](https://attack.mitre.org/software/S0486) can use the <code>ps</code> command to discover other cryptocurrency miners active on the system.(Citation: ESET ForSSHe December 2018)","relationship_id":"relationship--f6030347-c316-4c5c-b7ce-84c39aa09f85","references":[{"source_name":"ESET ForSSHe December 2018","description":"Dumont, R., M.Léveillé, M., Porcher, H. (2018, December 1). THE DARK SIDE OF THE FORSSHE A landscape of OpenSSH backdoors. Retrieved July 16, 2020.","url":"https://www.welivesecurity.com/wp-content/uploads/2018/12/ESET-The_Dark_Side_of_the_ForSSHe.pdf"}]},{"id":"S0491","name":"StrongPity","url":"https://attack.mitre.org/software/S0491","kind":"malware","description":"[StrongPity](https://attack.mitre.org/software/S0491) can determine if a user is logged in by checking to see if explorer.exe is running.(Citation: Talos Promethium June 2020)","relationship_id":"relationship--de0ee6e1-6b97-40be-b036-5339db13e6e4","references":[{"source_name":"Talos Promethium June 2020","description":"Mercer, W. et al. (2020, June 29). PROMETHIUM extends global reach with StrongPity3 APT. Retrieved July 20, 2020.","url":"https://blog.talosintelligence.com/2020/06/promethium-extends-with-strongpity3.html"}]},{"id":"S0497","name":"Dacls","url":"https://attack.mitre.org/software/S0497","kind":"malware","description":"[Dacls](https://attack.mitre.org/software/S0497) can collect data on running and parent processes.(Citation: TrendMicro macOS Dacls May 2020)","relationship_id":"relationship--4001577c-16aa-4edc-ba15-1f0f9ba35c13","references":[{"source_name":"TrendMicro macOS Dacls May 2020","description":"Mabutas, G. (2020, May 11). New MacOS Dacls RAT Backdoor Shows Lazarus’ Multi-Platform Attack Capability. Retrieved August 10, 2020.","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/new-macos-dacls-rat-backdoor-show-lazarus-multi-platform-attack-capability/"}]},{"id":"S0501","name":"PipeMon","url":"https://attack.mitre.org/software/S0501","kind":"malware","description":"[PipeMon](https://attack.mitre.org/software/S0501) can iterate over the running processes to find a suitable injection target.(Citation: ESET PipeMon May 2020)","relationship_id":"relationship--8ead6aa1-dbbe-4e8f-b542-66af9b5f2c33","references":[{"source_name":"ESET PipeMon May 2020","description":"Tartare, M. et al. (2020, May 21). No “Game over” for the Winnti Group. Retrieved August 24, 2020.","url":"https://www.welivesecurity.com/2020/05/21/no-game-over-winnti-group/"}]},{"id":"S0503","name":"FrameworkPOS","url":"https://attack.mitre.org/software/S0503","kind":"malware","description":"[FrameworkPOS](https://attack.mitre.org/software/S0503) can enumerate and exclude selected processes on a compromised host to speed execution of memory scraping.(Citation: SentinelOne FrameworkPOS September 2019)","relationship_id":"relationship--b72be1af-b4d0-4607-8f97-377d23ddbb36","references":[{"source_name":"SentinelOne FrameworkPOS September 2019","description":"Kremez, V. (2019, September 19). FIN6 “FrameworkPOS”: Point-of-Sale Malware Analysis & Internals. Retrieved September 8, 2020.","url":"https://labs.sentinelone.com/fin6-frameworkpos-point-of-sale-malware-analysis-internals-2/"}]},{"id":"S0512","name":"FatDuke","url":"https://attack.mitre.org/software/S0512","kind":"malware","description":"[FatDuke](https://attack.mitre.org/software/S0512) can list running processes on the localhost.(Citation: ESET Dukes October 2019)","relationship_id":"relationship--7380936d-51af-4ee3-b729-9c56a203bdee","references":[{"source_name":"ESET Dukes October 2019","description":"Faou, M., Tartare, M., Dupuy, T. (2019, October). OPERATION GHOST. Retrieved September 23, 2020.","url":"https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Operation_Ghost_Dukes.pdf"}]},{"id":"S0516","name":"SoreFang","url":"https://attack.mitre.org/software/S0516","kind":"malware","description":"[SoreFang](https://attack.mitre.org/software/S0516) can enumerate processes on a victim machine through use of [Tasklist](https://attack.mitre.org/software/S0057).(Citation: CISA SoreFang July 2016)","relationship_id":"relationship--1ed17f60-d6ca-4ef7-ae52-7a573c2a7ff3","references":[{"source_name":"CISA SoreFang July 2016","description":"CISA. (2020, July 16). MAR-10296782-1.v1 – SOREFANG. Retrieved September 29, 2020.","url":"https://us-cert.cisa.gov/ncas/analysis-reports/ar20-198a"}]},{"id":"S0517","name":"Pillowmint","url":"https://attack.mitre.org/software/S0517","kind":"malware","description":"[Pillowmint](https://attack.mitre.org/software/S0517) can iterate through running processes every six seconds collecting a list of processes to capture from later.(Citation: Trustwave Pillowmint June 2020)\t","relationship_id":"relationship--8977c8db-64e4-44b5-bee9-362779624a42","references":[{"source_name":"Trustwave Pillowmint June 2020","description":"Trustwave SpiderLabs. (2020, June 22). Pillowmint: FIN7’s Monkey Thief . Retrieved July 27, 2020.","url":"https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/pillowmint-fin7s-monkey-thief/"}]},{"id":"S0528","name":"Javali","url":"https://attack.mitre.org/software/S0528","kind":"malware","description":"[Javali](https://attack.mitre.org/software/S0528) can monitor processes for open browsers and custom banking applications.(Citation: Securelist Brazilian Banking Malware July 2020)","relationship_id":"relationship--4faef092-6721-408c-9135-70c6ad824a07","references":[{"source_name":"Securelist Brazilian Banking Malware July 2020","description":"GReAT. (2020, July 14). The Tetrade: Brazilian banking malware goes global. Retrieved November 9, 2020.","url":"https://securelist.com/the-tetrade-brazilian-banking-malware/97779/"}]},{"id":"S0531","name":"Grandoreiro","url":"https://attack.mitre.org/software/S0531","kind":"malware","description":"[Grandoreiro](https://attack.mitre.org/software/S0531) can identify installed security tools based on process names.(Citation: ESET Grandoreiro April 2020)","relationship_id":"relationship--13ab9b58-b18a-437f-898e-fc598e8d0939","references":[{"source_name":"ESET Grandoreiro April 2020","description":"ESET. (2020, April 28). Grandoreiro: How engorged can an EXE get?. Retrieved November 13, 2020.","url":"https://www.welivesecurity.com/2020/04/28/grandoreiro-how-engorged-can-exe-get/"}]},{"id":"S0532","name":"Lucifer","url":"https://attack.mitre.org/software/S0532","kind":"malware","description":"[Lucifer](https://attack.mitre.org/software/S0532) can identify the process that owns remote connections.(Citation: Unit 42 Lucifer June 2020)","relationship_id":"relationship--23c028d1-6963-4033-b91f-5953413df43c","references":[{"source_name":"Unit 42 Lucifer June 2020","description":"Hsu, K. et al. (2020, June 24). Lucifer: New Cryptojacking and DDoS Hybrid Malware Exploiting High and Critical Vulnerabilities to Infect Windows Devices. Retrieved November 16, 2020.","url":"https://unit42.paloaltonetworks.com/lucifer-new-cryptojacking-and-ddos-hybrid-malware/"}]},{"id":"S0533","name":"SLOTHFULMEDIA","url":"https://attack.mitre.org/software/S0533","kind":"malware","description":"[SLOTHFULMEDIA](https://attack.mitre.org/software/S0533) has enumerated processes by ID, name, or privileges.(Citation: CISA MAR SLOTHFULMEDIA October 2020) ","relationship_id":"relationship--cd68ff0c-88c9-4a71-82ff-f16da53ed8ed","references":[{"source_name":"CISA MAR SLOTHFULMEDIA October 2020","description":"DHS/CISA, Cyber National Mission Force. (2020, October 1). Malware Analysis Report (MAR) MAR-10303705-1.v1 – Remote Access Trojan: SLOTHFULMEDIA. Retrieved October 2, 2020.","url":"https://us-cert.cisa.gov/ncas/analysis-reports/ar20-275a"}]},{"id":"S0534","name":"Bazar","url":"https://attack.mitre.org/software/S0534","kind":"malware","description":"[Bazar](https://attack.mitre.org/software/S0534) can identity the current process on a compromised host.(Citation: Cybereason Bazar July 2020)","relationship_id":"relationship--6e6f67c0-ba84-48f2-a322-2a7cb7a5cd02","references":[{"source_name":"Cybereason Bazar July 2020","description":"Cybereason Nocturnus. (2020, July 16). A BAZAR OF TRICKS: FOLLOWING TEAM9’S DEVELOPMENT CYCLES. Retrieved November 18, 2020.","url":"https://www.cybereason.com/blog/a-bazar-of-tricks-following-team9s-development-cycles"}]},{"id":"S0559","name":"SUNBURST","url":"https://attack.mitre.org/software/S0559","kind":"malware","description":"[SUNBURST](https://attack.mitre.org/software/S0559) collected a list of process names that were hashed using a FNV-1a + XOR algorithm to check against similarly-hashed hardcoded blocklists.(Citation: FireEye SUNBURST Backdoor December 2020)","relationship_id":"relationship--988f5b4b-bfc7-4714-b6f0-f753c0472cab","references":[{"source_name":"FireEye SUNBURST Backdoor December 2020","description":"FireEye. (2020, December 13). Highly Evasive Attacker Leverages SolarWinds Supply Chain to Compromise Multiple Global Victims With SUNBURST Backdoor. Retrieved January 4, 2021.","url":"https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html"}]},{"id":"S0562","name":"SUNSPOT","url":"https://attack.mitre.org/software/S0562","kind":"malware","description":"[SUNSPOT](https://attack.mitre.org/software/S0562) monitored running processes for instances of <code>MsBuild.exe</code> by hashing the name of each running process and comparing it to the corresponding value <code>0x53D525</code>. It also extracted command-line arguments and individual arguments from the running <code>MsBuild.exe</code> process to identify the directory path of the Orion software Visual Studio solution.(Citation: CrowdStrike SUNSPOT Implant January 2021)","relationship_id":"relationship--09f6307c-819e-4e35-bfc7-5314b0c3ce85","references":[{"source_name":"CrowdStrike SUNSPOT Implant January 2021","description":"CrowdStrike Intelligence Team. (2021, January 11). SUNSPOT: An Implant in the Build Process. Retrieved January 11, 2021.","url":"https://www.crowdstrike.com/blog/sunspot-malware-technical-analysis/"}]},{"id":"S0567","name":"Dtrack","url":"https://attack.mitre.org/software/S0567","kind":"malware","description":"[Dtrack](https://attack.mitre.org/software/S0567)’s dropper can list all running processes.(Citation: Securelist Dtrack)(Citation: CyberBit Dtrack)","relationship_id":"relationship--be366a5f-308d-42aa-ae76-f14dbbb8b136","references":[{"source_name":"Securelist Dtrack","description":"Konstantin Zykov. (2019, September 23). Hello! My name is Dtrack. Retrieved January 20, 2021.","url":"https://securelist.com/my-name-is-dtrack/93338/"},{"source_name":"CyberBit Dtrack","description":"Hod Gavriel. (2019, November 21). Dtrack: In-depth analysis of APT on a nuclear power plant. Retrieved January 20, 2021.","url":"https://www.cyberbit.com/blog/endpoint-security/dtrack-apt-malware-found-in-nuclear-power-plant/"}]},{"id":"S0572","name":"Caterpillar WebShell","url":"https://attack.mitre.org/software/S0572","kind":"malware","description":"[Caterpillar WebShell](https://attack.mitre.org/software/S0572) can gather a list of processes running on the machine.(Citation: ClearSky Lebanese Cedar Jan 2021) ","relationship_id":"relationship--333c5688-edc4-40ba-a382-e98f4473d8c7","references":[{"source_name":"ClearSky Lebanese Cedar Jan 2021","description":"ClearSky Cyber Security. (2021, January). “Lebanese Cedar” APT Global Lebanese Espionage Campaign Leveraging Web Servers. Retrieved February 10, 2021.","url":"https://www.clearskysec.com/wp-content/uploads/2021/01/Lebanese-Cedar-APT.pdf"}]},{"id":"S0575","name":"Conti","url":"https://attack.mitre.org/software/S0575","kind":"malware","description":"[Conti](https://attack.mitre.org/software/S0575) can enumerate through all open processes to search for any that have the string “sql” in their process name.(Citation: CarbonBlack Conti July 2020)","relationship_id":"relationship--eacc205b-b8f9-4427-b8bd-3eba5a5a6179","references":[{"source_name":"CarbonBlack Conti July 2020","description":"Baskin, B. (2020, July 8). TAU Threat Discovery: Conti Ransomware. Retrieved February 17, 2021.","url":"https://www.carbonblack.com/blog/tau-threat-discovery-conti-ransomware/"}]},{"id":"S0579","name":"Waterbear","url":"https://attack.mitre.org/software/S0579","kind":"malware","description":"[Waterbear](https://attack.mitre.org/software/S0579) can identify the process for a specific security product.(Citation: Trend Micro Waterbear December 2019)","relationship_id":"relationship--d9b4c254-8e05-4410-ae4d-a47f55e6bf51","references":[{"source_name":"Trend Micro Waterbear December 2019","description":"Su, V. et al. (2019, December 11). Waterbear Returns, Uses API Hooking to Evade Security. Retrieved February 22, 2021.","url":"https://www.trendmicro.com/en_us/research/19/l/waterbear-is-back-uses-api-hooking-to-evade-security-product-detection.html"}]},{"id":"S0581","name":"IronNetInjector","url":"https://attack.mitre.org/software/S0581","kind":"tool","description":"[IronNetInjector](https://attack.mitre.org/software/S0581) can identify processes via C# methods such as <code>GetProcessesByName</code> and running [Tasklist](https://attack.mitre.org/software/S0057) with the Python <code>os.popen</code> function.(Citation: Unit 42 IronNetInjector February 2021 )","relationship_id":"relationship--10b4ef89-5f69-4809-a410-37256407b5fa","references":[{"source_name":"Unit 42 IronNetInjector February 2021 ","description":"Reichel, D. (2021, February 19). IronNetInjector: Turla’s New Malware Loading Tool. Retrieved February 24, 2021.","url":"https://unit42.paloaltonetworks.com/ironnetinjector/"}]},{"id":"S0582","name":"LookBack","url":"https://attack.mitre.org/software/S0582","kind":"malware","description":"[LookBack](https://attack.mitre.org/software/S0582) can list running processes.(Citation: Proofpoint LookBack Malware Aug 2019)","relationship_id":"relationship--65f12d79-f04e-441d-8068-1962963c4965","references":[{"source_name":"Proofpoint LookBack Malware Aug 2019","description":"Raggi, M. Schwarz, D.. (2019, August 1). LookBack Malware Targets the United States Utilities Sector with Phishing Attacks Impersonating Engineering Licensing Boards. Retrieved February 25, 2021.","url":"https://www.proofpoint.com/us/threat-insight/post/lookback-malware-targets-united-states-utilities-sector-phishing-attacks"}]},{"id":"S0586","name":"TAINTEDSCRIBE","url":"https://attack.mitre.org/software/S0586","kind":"malware","description":"[TAINTEDSCRIBE](https://attack.mitre.org/software/S0586) can execute <code>ProcessList</code> for process discovery.(Citation: CISA MAR-10288834-2.v1  TAINTEDSCRIBE MAY 2020)","relationship_id":"relationship--40ab538b-9386-4559-8861-098503d3770f","references":[{"source_name":"CISA MAR-10288834-2.v1  TAINTEDSCRIBE MAY 2020","description":"USG. (2020, May 12). MAR-10288834-2.v1 – North Korean Trojan: TAINTEDSCRIBE. Retrieved March 5, 2021.","url":"https://us-cert.cisa.gov/ncas/analysis-reports/ar20-133b"}]},{"id":"S0595","name":"ThiefQuest","url":"https://attack.mitre.org/software/S0595","kind":"malware","description":"[ThiefQuest](https://attack.mitre.org/software/S0595) obtains a list of running processes using the function <code>kill_unwanted</code>.(Citation: wardle evilquest parti)","relationship_id":"relationship--c85af3d4-ab10-4c49-91c4-bff9054096b8","references":[{"source_name":"wardle evilquest parti","description":"Patrick Wardle. (2020, June 29). OSX.EvilQuest Uncovered part i: infection, persistence, and more!. Retrieved March 18, 2021.","url":"https://objective-see.com/blog/blog_0x59.html"}]},{"id":"S0596","name":"ShadowPad","url":"https://attack.mitre.org/software/S0596","kind":"malware","description":"[ShadowPad](https://attack.mitre.org/software/S0596) has collected the PID of a malicious process.(Citation: Kaspersky ShadowPad Aug 2017)","relationship_id":"relationship--931a5425-011a-42b5-ae49-fba9c70572b6","references":[{"source_name":"Kaspersky ShadowPad Aug 2017","description":"Kaspersky Lab. (2017, August). ShadowPad: popular server management software hit in supply chain attack. Retrieved March 22, 2021.","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2017/08/07172148/ShadowPad_technical_description_PDF.pdf"}]},{"id":"S0599","name":"Kinsing","url":"https://attack.mitre.org/software/S0599","kind":"malware","description":"[Kinsing](https://attack.mitre.org/software/S0599) has used ps to list processes.(Citation: Aqua Kinsing April 2020)","relationship_id":"relationship--df0d2dad-d384-4501-b2bc-659a7877489b","references":[{"source_name":"Aqua Kinsing April 2020","description":"Singer, G. (2020, April 3). Threat Alert: Kinsing Malware Attacks Targeting Container Environments. Retrieved April 1, 2021.","url":"https://blog.aquasec.com/threat-alert-kinsing-malware-container-vulnerability"}]},{"id":"S0600","name":"Doki","url":"https://attack.mitre.org/software/S0600","kind":"malware","description":"[Doki](https://attack.mitre.org/software/S0600) has searched for the current process’s PID.(Citation: Intezer Doki July 20)","relationship_id":"relationship--fbfb4e97-11d5-497a-8d57-a9ebe5254f56","references":[{"source_name":"Intezer Doki July 20","description":"Fishbein, N., Kajiloti, M.. (2020, July 28). Watch Your Containers: Doki Infecting Docker Servers in the Cloud. Retrieved March 30, 2021.","url":"https://www.intezer.com/blog/cloud-security/watch-your-containers-doki-infecting-docker-servers-in-the-cloud/"}]},{"id":"S0605","name":"EKANS","url":"https://attack.mitre.org/software/S0605","kind":"malware","description":"[EKANS](https://attack.mitre.org/software/S0605) looks for processes from a hard-coded list.(Citation: Dragos EKANS)(Citation: FireEye Ransomware Feb 2020)(Citation: IBM Ransomware Trends September 2020)","relationship_id":"relationship--2c1758b2-6809-48f5-84f1-e82afa950a9f","references":[{"source_name":"Dragos EKANS","description":"Dragos. (2020, February 3). EKANS Ransomware and ICS Operations. Retrieved February 9, 2021.","url":"https://www.dragos.com/blog/industry-news/ekans-ransomware-and-ics-operations/"},{"source_name":"FireEye Ransomware Feb 2020","description":"Zafra, D., et al. (2020, February 24). Ransomware Against the Machine: How Adversaries are Learning to Disrupt Industrial Production by Targeting IT and OT. Retrieved March 2, 2021.","url":"https://www.fireeye.com/blog/threat-research/2020/02/ransomware-against-machine-learning-to-disrupt-industrial-production.html"},{"source_name":"IBM Ransomware Trends September 2020","description":"Singleton, C. and Kiefer, C. (2020, September 28). Ransomware 2020: Attack Trends Affecting Organizations Worldwide. Retrieved September 20, 2021.","url":"https://securityintelligence.com/posts/ransomware-2020-attack-trends-new-techniques-affecting-organizations-worldwide/"}]},{"id":"S0606","name":"Bad Rabbit","url":"https://attack.mitre.org/software/S0606","kind":"malware","description":"[Bad Rabbit](https://attack.mitre.org/software/S0606) can enumerate all running processes to compare hashes.(Citation: Secure List Bad Rabbit)","relationship_id":"relationship--70b27780-b19a-4313-88ea-1038ce0fc386","references":[{"source_name":"Secure List Bad Rabbit","description":"Mamedov, O. Sinitsyn, F.  Ivanov, A.. (2017, October 24). Bad Rabbit ransomware. Retrieved January 28, 2021.","url":"https://securelist.com/bad-rabbit-ransomware/82851/"}]},{"id":"S0607","name":"KillDisk","url":"https://attack.mitre.org/software/S0607","kind":"malware","description":"[KillDisk](https://attack.mitre.org/software/S0607) has called <code>GetCurrentProcess</code>.(Citation: Trend Micro KillDisk 2)","relationship_id":"relationship--75c7794b-e8e1-4fcb-b59a-14eb710c47f7","references":[{"source_name":"Trend Micro KillDisk 2","description":"Gilbert Sison, Rheniel Ramos, Jay Yaneza, Alfredo Oliveira. (2018, January 15). KillDisk Variant Hits Latin American Financial Groups. Retrieved January 12, 2021.","url":"https://www.trendmicro.com/en_us/research/18/a/new-killdisk-variant-hits-financial-organizations-in-latin-america.html"}]},{"id":"S0611","name":"Clop","url":"https://attack.mitre.org/software/S0611","kind":"malware","description":"[Clop](https://attack.mitre.org/software/S0611) can enumerate all processes on the victim's machine.(Citation: Mcafee Clop Aug 2019)","relationship_id":"relationship--83089e74-f35d-4b1d-9036-4e49edd82bd0","references":[{"source_name":"Mcafee Clop Aug 2019","description":"Mundo, A. (2019, August 1). Clop Ransomware. Retrieved May 10, 2021.","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/clop-ransomware/"}]},{"id":"S0615","name":"SombRAT","url":"https://attack.mitre.org/software/S0615","kind":"malware","description":"[SombRAT](https://attack.mitre.org/software/S0615) can use the <code>getprocesslist</code> command to enumerate processes on a compromised host.(Citation: BlackBerry CostaRicto November 2020)(Citation: FireEye FiveHands April 2021)(Citation: CISA AR21-126A FIVEHANDS May 2021)","relationship_id":"relationship--18c07e03-0456-4854-bf63-07eb6d6bd868","references":[{"source_name":"BlackBerry CostaRicto November 2020","description":"The BlackBerry Research and Intelligence Team. (2020, November 12). The CostaRicto Campaign: Cyber-Espionage Outsourced. Retrieved May 24, 2021.","url":"https://blogs.blackberry.com/en/2020/11/the-costaricto-campaign-cyber-espionage-outsourced"},{"source_name":"FireEye FiveHands April 2021","description":"McLellan, T.  and Moore, J. et al. (2021, April 29). UNC2447 SOMBRAT and FIVEHANDS Ransomware: A Sophisticated Financial Threat. Retrieved June 2, 2021.","url":"https://www.fireeye.com/blog/threat-research/2021/04/unc2447-sombrat-and-fivehands-ransomware-sophisticated-financial-threat.html"},{"source_name":"CISA AR21-126A FIVEHANDS May 2021","description":"CISA. (2021, May 6). Analysis Report (AR21-126A) FiveHands Ransomware. Retrieved June 7, 2021.","url":"https://us-cert.cisa.gov/ncas/analysis-reports/ar21-126a"}]},{"id":"S0617","name":"HELLOKITTY","url":"https://attack.mitre.org/software/S0617","kind":"malware","description":"[HELLOKITTY](https://attack.mitre.org/software/S0617) can search for specific processes to terminate.(Citation: FireEye FiveHands April 2021)","relationship_id":"relationship--a969a06c-523f-4cde-a92c-539dd1c003f9","references":[{"source_name":"FireEye FiveHands April 2021","description":"McLellan, T.  and Moore, J. et al. (2021, April 29). UNC2447 SOMBRAT and FIVEHANDS Ransomware: A Sophisticated Financial Threat. Retrieved June 2, 2021.","url":"https://www.fireeye.com/blog/threat-research/2021/04/unc2447-sombrat-and-fivehands-ransomware-sophisticated-financial-threat.html"}]},{"id":"S0622","name":"AppleSeed","url":"https://attack.mitre.org/software/S0622","kind":"malware","description":"[AppleSeed](https://attack.mitre.org/software/S0622) can enumerate the current process on a compromised host.(Citation: Malwarebytes Kimsuky June 2021)","relationship_id":"relationship--49944838-b6f8-4e1c-94d4-5b70cb436700","references":[{"source_name":"Malwarebytes Kimsuky June 2021","description":"Jazi, H. (2021, June 1). Kimsuky APT continues to target South Korean government using AppleSeed backdoor. Retrieved June 10, 2021.","url":"https://blog.malwarebytes.com/threat-analysis/2021/06/kimsuky-apt-continues-to-target-south-korean-government-using-appleseed-backdoor/"}]},{"id":"S0625","name":"Cuba","url":"https://attack.mitre.org/software/S0625","kind":"malware","description":"[Cuba](https://attack.mitre.org/software/S0625) can enumerate processes running on a victim's machine.(Citation: McAfee Cuba April 2021)","relationship_id":"relationship--c253f0c5-1802-4853-b93f-c426d2a48fae","references":[{"source_name":"McAfee Cuba April 2021","description":"Roccio, T., et al. (2021, April). Technical Analysis of Cuba Ransomware. Retrieved June 18, 2021.","url":"https://www.mcafee.com/enterprise/en-us/assets/reports/rp-cuba-ransomware.pdf"}]},{"id":"S0626","name":"P8RAT","url":"https://attack.mitre.org/software/S0626","kind":"malware","description":"[P8RAT](https://attack.mitre.org/software/S0626) can check for specific processes associated with virtual environments.(Citation: Securelist APT10 March 2021)","relationship_id":"relationship--56e2010e-20d2-4484-b8ee-742b81b8fcdb","references":[{"source_name":"Securelist APT10 March 2021","description":"GREAT. (2021, March 30). APT10: sophisticated multi-layered loader Ecipekac discovered in A41APT campaign. Retrieved June 17, 2021.","url":"https://securelist.com/apt10-sophisticated-multi-layered-loader-ecipekac-discovered-in-a41apt-campaign/101519/"}]},{"id":"S0627","name":"SodaMaster","url":"https://attack.mitre.org/software/S0627","kind":"malware","description":"[SodaMaster](https://attack.mitre.org/software/S0627) can search a list of running processes.(Citation: Securelist APT10 March 2021)","relationship_id":"relationship--c9fa803b-3d37-49bc-b0b3-ec409ad372fa","references":[{"source_name":"Securelist APT10 March 2021","description":"GREAT. (2021, March 30). APT10: sophisticated multi-layered loader Ecipekac discovered in A41APT campaign. Retrieved June 17, 2021.","url":"https://securelist.com/apt10-sophisticated-multi-layered-loader-ecipekac-discovered-in-a41apt-campaign/101519/"}]},{"id":"S0629","name":"RainyDay","url":"https://attack.mitre.org/software/S0629","kind":"malware","description":"[RainyDay](https://attack.mitre.org/software/S0629) can enumerate processes on a target system.(Citation: Bitdefender Naikon April 2021)","relationship_id":"relationship--66addef3-8b7a-4571-b919-2b70f5991990","references":[{"source_name":"Bitdefender Naikon April 2021","description":"Vrabie, V. (2021, April 23). NAIKON – Traces from a Military Cyber-Espionage Operation. Retrieved June 29, 2021.","url":"https://www.bitdefender.com/files/News/CaseStudies/study/396/Bitdefender-PR-Whitepaper-NAIKON-creat5397-en-EN.pdf"}]},{"id":"S0630","name":"Nebulae","url":"https://attack.mitre.org/software/S0630","kind":"malware","description":"[Nebulae](https://attack.mitre.org/software/S0630) can enumerate processes on a target system.(Citation: Bitdefender Naikon April 2021)","relationship_id":"relationship--6e9ca726-0934-4181-a4e6-51ad9d110318","references":[{"source_name":"Bitdefender Naikon April 2021","description":"Vrabie, V. (2021, April 23). NAIKON – Traces from a Military Cyber-Espionage Operation. Retrieved June 29, 2021.","url":"https://www.bitdefender.com/files/News/CaseStudies/study/396/Bitdefender-PR-Whitepaper-NAIKON-creat5397-en-EN.pdf"}]},{"id":"S0638","name":"Babuk","url":"https://attack.mitre.org/software/S0638","kind":"malware","description":"[Babuk](https://attack.mitre.org/software/S0638) has the ability to check running processes on a targeted system.(Citation: Sogeti CERT ESEC Babuk March 2021)(Citation: McAfee Babuk February 2021)(Citation: Trend Micro Ransomware February 2021)","relationship_id":"relationship--cd91751c-a2a2-4626-bb31-b95fd0040818","references":[{"source_name":"Sogeti CERT ESEC Babuk March 2021","description":"Sogeti. (2021, March). Babuk Ransomware. Retrieved August 11, 2021.","url":"https://www.sogeti.com/globalassets/reports/cybersecchronicles_-_babuk.pdf"},{"source_name":"McAfee Babuk February 2021","description":"Mundo, A. et al. (2021, February). Technical Analysis of Babuk Ransomware. Retrieved August 11, 2021.","url":"https://www.mcafee.com/enterprise/en-us/assets/reports/rp-babuk-ransomware.pdf"},{"source_name":"Trend Micro Ransomware February 2021","description":"Centero, R. et al. (2021, February 5). New in Ransomware: Seth-Locker, Babuk Locker, Maoloa, TeslaCrypt, and CobraLocker. Retrieved August 11, 2021.","url":"https://www.trendmicro.com/en_us/research/21/b/new-in-ransomware.html"}]},{"id":"S0640","name":"Avaddon","url":"https://attack.mitre.org/software/S0640","kind":"malware","description":"[Avaddon](https://attack.mitre.org/software/S0640) has collected information about running processes.(Citation: Arxiv Avaddon Feb 2021)","relationship_id":"relationship--5b37bd8c-d5a6-4564-a110-bb515ff9f78c","references":[{"source_name":"Arxiv Avaddon Feb 2021","description":"Yuste, J. Pastrana, S. (2021, February 9). Avaddon ransomware: an in-depth analysis and decryption of infected systems. Retrieved August 19, 2021.","url":"https://arxiv.org/pdf/2102.04796.pdf"}]},{"id":"S0644","name":"ObliqueRAT","url":"https://attack.mitre.org/software/S0644","kind":"malware","description":"[ObliqueRAT](https://attack.mitre.org/software/S0644) can check for blocklisted process names on a compromised host.(Citation: Talos Oblique RAT March 2021)","relationship_id":"relationship--c5dffed7-7e56-4cee-8f96-065b4718000d","references":[{"source_name":"Talos Oblique RAT March 2021","description":"Malhotra, A. (2021, March 2). ObliqueRAT returns with new campaign using hijacked websites. Retrieved September 2, 2021.","url":"https://blog.talosintelligence.com/2021/02/obliquerat-new-campaign.html"}]},{"id":"S0650","name":"QakBot","url":"https://attack.mitre.org/software/S0650","kind":"malware","description":"[QakBot](https://attack.mitre.org/software/S0650) has the ability to check running processes.(Citation: ATT QakBot April 2021)","relationship_id":"relationship--6a1828c6-bba9-4285-a8af-5017b096252a","references":[{"source_name":"ATT QakBot April 2021","description":"Morrow, D. (2021, April 15). The rise of QakBot. Retrieved September 27, 2021.","url":"https://cybersecurity.att.com/blogs/labs-research/the-rise-of-qakbot"}]},{"id":"S0652","name":"MarkiRAT","url":"https://attack.mitre.org/software/S0652","kind":"malware","description":"[MarkiRAT](https://attack.mitre.org/software/S0652) can search for different processes on a system.(Citation: Kaspersky Ferocious Kitten Jun 2021)","relationship_id":"relationship--af766021-c066-416c-80ba-9687f5641457","references":[{"source_name":"Kaspersky Ferocious Kitten Jun 2021","description":"GReAT. (2021, June 16). Ferocious Kitten: 6 Years of Covert Surveillance in Iran. Retrieved September 22, 2021.","url":"https://securelist.com/ferocious-kitten-6-years-of-covert-surveillance-in-iran/102806/"}]},{"id":"S0657","name":"BLUELIGHT","url":"https://attack.mitre.org/software/S0657","kind":"malware","description":"[BLUELIGHT](https://attack.mitre.org/software/S0657) can collect process filenames and SID authority level.(Citation: Volexity InkySquid BLUELIGHT August 2021)","relationship_id":"relationship--9d1a9a04-6174-4aaa-8fac-43c965f0bd38","references":[{"source_name":"Volexity InkySquid BLUELIGHT August 2021","description":"Cash, D., Grunzweig, J., Meltzer, M., Adair, S., Lancaster, T. (2021, August 17). North Korean APT InkySquid Infects Victims Using Browser Exploits. Retrieved September 30, 2021.","url":"https://www.volexity.com/blog/2021/08/17/north-korean-apt-inkysquid-infects-victims-using-browser-exploits/"}]},{"id":"S0659","name":"Diavol","url":"https://attack.mitre.org/software/S0659","kind":"malware","description":"[Diavol](https://attack.mitre.org/software/S0659) has used `CreateToolhelp32Snapshot`, `Process32First`, and `Process32Next` API calls to enumerate the running processes in the system.(Citation: Fortinet Diavol July 2021)","relationship_id":"relationship--31667cdd-1ac5-46f5-8dbd-9ebaf09f00a9","references":[{"source_name":"Fortinet Diavol July 2021","description":"Neeamni, D., Rubinfeld, A.. (2021, July 1). Diavol - A New Ransomware Used By Wizard Spider?. Retrieved November 12, 2021.","url":"https://www.fortinet.com/blog/threat-research/diavol-new-ransomware-used-by-wizard-spider"}]},{"id":"S0660","name":"Clambling","url":"https://attack.mitre.org/software/S0660","kind":"malware","description":"[Clambling](https://attack.mitre.org/software/S0660) can enumerate processes on a targeted system.(Citation: Trend Micro DRBControl February 2020)","relationship_id":"relationship--b0147ed6-a725-4899-82dd-4675aeecbd72","references":[{"source_name":"Trend Micro DRBControl February 2020","description":"Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021.","url":"https://documents.trendmicro.com/assets/white_papers/wp-uncovering-DRBcontrol.pdf"}]},{"id":"S0661","name":"FoggyWeb","url":"https://attack.mitre.org/software/S0661","kind":"malware","description":"[FoggyWeb](https://attack.mitre.org/software/S0661)'s loader can enumerate all Common Language Runtimes (CLRs) and running Application Domains in the compromised AD FS server's <code>Microsoft.IdentityServer.ServiceHost.exe</code> process.(Citation: MSTIC FoggyWeb September 2021)","relationship_id":"relationship--6d91c756-df9c-4fbe-9489-2cf6cf7ba206","references":[{"source_name":"MSTIC FoggyWeb September 2021","description":"Ramin Nafisi. (2021, September 27). FoggyWeb: Targeted NOBELIUM malware leads to persistent backdoor. Retrieved October 4, 2021.","url":"https://www.microsoft.com/security/blog/2021/09/27/foggyweb-targeted-nobelium-malware-leads-to-persistent-backdoor/"}]},{"id":"S0662","name":"RCSession","url":"https://attack.mitre.org/software/S0662","kind":"malware","description":"[RCSession](https://attack.mitre.org/software/S0662) can identify processes based on PID.(Citation: Profero APT27 December 2020)","relationship_id":"relationship--2a47008b-49af-4ecc-b018-ef92786ead72","references":[{"source_name":"Profero APT27 December 2020","description":"Global Threat Center, Intelligence Team. (2020, December). APT27 Turns to Ransomware. Retrieved November 12, 2021.","url":"https://web.archive.org/web/20210104144857/https://shared-public-reports.s3-eu-west-1.amazonaws.com/APT27+turns+to+ransomware.pdf"}]},{"id":"S0663","name":"SysUpdate","url":"https://attack.mitre.org/software/S0663","kind":"malware","description":"[SysUpdate](https://attack.mitre.org/software/S0663) can collect information about running processes.(Citation: Lunghi Iron Tiger Linux)","relationship_id":"relationship--29d1fe5a-4ea4-4fb2-8b64-afcceee45d10","references":[{"source_name":"Lunghi Iron Tiger Linux","description":"Daniel Lunghi. (2023, March 1). Iron Tiger’s SysUpdate Reappears, Adds Linux Targeting. Retrieved March 20, 2023.","url":"https://www.trendmicro.com/en_us/research/23/c/iron-tiger-sysupdate-adds-linux-targeting.html"}]},{"id":"S0664","name":"Pandora","url":"https://attack.mitre.org/software/S0664","kind":"malware","description":"[Pandora](https://attack.mitre.org/software/S0664) can monitor processes on a compromised host.(Citation: Trend Micro Iron Tiger April 2021)","relationship_id":"relationship--7a78758b-9dce-4d13-9b8a-ddc9b31d4ff7","references":[{"source_name":"Trend Micro Iron Tiger April 2021","description":"Lunghi, D. and Lu, K. (2021, April 9). Iron Tiger APT Updates Toolkit With Evolved SysUpdate Malware. Retrieved November 12, 2021.","url":"https://www.trendmicro.com/en_us/research/21/d/iron-tiger-apt-updates-toolkit-with-evolved-sysupdate-malware-va.html"}]},{"id":"S0666","name":"Gelsemium","url":"https://attack.mitre.org/software/S0666","kind":"malware","description":"[Gelsemium](https://attack.mitre.org/software/S0666) can enumerate running processes.(Citation: ESET Gelsemium June 2021)","relationship_id":"relationship--5d81254d-9a66-49ea-9635-187da26d4a97","references":[{"source_name":"ESET Gelsemium June 2021","description":"Dupuy, T. and Faou, M. (2021, June). Gelsemium. Retrieved November 30, 2021.","url":"https://www.welivesecurity.com/wp-content/uploads/2021/06/eset_gelsemium.pdf"}]},{"id":"S0670","name":"WarzoneRAT","url":"https://attack.mitre.org/software/S0670","kind":"malware","description":"[WarzoneRAT](https://attack.mitre.org/software/S0670) can obtain a list of processes on a compromised host.(Citation: Check Point Warzone Feb 2020)","relationship_id":"relationship--057815bb-550c-4e00-bfdb-c7e4bf6461cb","references":[{"source_name":"Check Point Warzone Feb 2020","description":"Harakhavik, Y. (2020, February 3). Warzone: Behind the enemy lines. Retrieved December 17, 2021.","url":"https://research.checkpoint.com/2020/warzone-behind-the-enemy-lines/"}]},{"id":"S0672","name":"Zox","url":"https://attack.mitre.org/software/S0672","kind":"malware","description":"[Zox](https://attack.mitre.org/software/S0672) has the ability to list processes.(Citation: Novetta-Axiom)","relationship_id":"relationship--ae05ae0a-7806-491a-8350-33600df44d2a","references":[{"source_name":"Novetta-Axiom","description":"Novetta. (n.d.). Operation SMN: Axiom Threat Actor Group Report. Retrieved November 12, 2014.","url":"https://web.archive.org/web/20230115144216/http://www.novetta.com/wp-content/uploads/2014/11/Executive_Summary-Final_1.pdf"}]},{"id":"S0674","name":"CharmPower","url":"https://attack.mitre.org/software/S0674","kind":"malware","description":"[CharmPower](https://attack.mitre.org/software/S0674) has the ability to list running processes through the use of `tasklist`.(Citation: Check Point APT35 CharmPower January 2022)","relationship_id":"relationship--a6175b80-3f45-4d17-9e00-67f32b973ea4","references":[{"source_name":"Check Point APT35 CharmPower January 2022","description":"Check Point. (2022, January 11). APT35 exploits Log4j vulnerability to distribute new modular PowerShell toolkit. Retrieved January 24, 2022.","url":"https://research.checkpoint.com/2022/apt35-exploits-log4j-vulnerability-to-distribute-new-modular-powershell-toolkit/"}]},{"id":"S0681","name":"Lizar","url":"https://attack.mitre.org/software/S0681","kind":"malware","description":"[Lizar](https://attack.mitre.org/software/S0681) has a plugin designed to obtain a list of processes.(Citation: Threatpost Lizar May 2021)(Citation: BiZone Lizar May 2021)","relationship_id":"relationship--e9a96b5e-5d6c-46c7-85df-ff16d1efeb4d","references":[{"source_name":"BiZone Lizar May 2021","description":"BI.ZONE Cyber Threats Research Team. (2021, May 13). From pentest to APT attack: cybercriminal group FIN7 disguises its malware as an ethical hacker’s toolkit. Retrieved February 2, 2022.","url":"https://bi-zone.medium.com/from-pentest-to-apt-attack-cybercriminal-group-fin7-disguises-its-malware-as-an-ethical-hackers-c23c9a75e319"},{"source_name":"Threatpost Lizar May 2021","description":"Seals, T. (2021, May 14). FIN7 Backdoor Masquerades as Ethical Hacking Tool. Retrieved February 2, 2022.","url":"https://threatpost.com/fin7-backdoor-ethical-hacking-tool/166194/"}]},{"id":"S0687","name":"Cyclops Blink","url":"https://attack.mitre.org/software/S0687","kind":"malware","description":"[Cyclops Blink](https://attack.mitre.org/software/S0687) can enumerate the process it is currently running under.(Citation: NCSC Cyclops Blink February 2022)","relationship_id":"relationship--8b3cb69c-7b85-4d52-8cab-867ea1126fc7","references":[{"source_name":"NCSC Cyclops Blink February 2022","description":"NCSC. (2022, February 23). Cyclops Blink Malware Analysis Report. Retrieved March 3, 2022.","url":"https://www.ncsc.gov.uk/files/Cyclops-Blink-Malware-Analysis-Report.pdf"}]},{"id":"S0688","name":"Meteor","url":"https://attack.mitre.org/software/S0688","kind":"malware","description":"[Meteor](https://attack.mitre.org/software/S0688) can check if a specific process is running, such as Kaspersky's `avp.exe`.(Citation: Check Point Meteor Aug 2021)","relationship_id":"relationship--f07c1f84-a2c0-4c47-904d-ce96b36307f0","references":[{"source_name":"Check Point Meteor Aug 2021","description":"Check Point Research Team. (2021, August 14). Indra - Hackers Behind Recent Attacks on Iran. Retrieved February 17, 2022.","url":"https://research.checkpoint.com/2021/indra-hackers-behind-recent-attacks-on-iran/"}]},{"id":"S0692","name":"SILENTTRINITY","url":"https://attack.mitre.org/software/S0692","kind":"tool","description":"[SILENTTRINITY](https://attack.mitre.org/software/S0692) can enumerate processes, including properties to determine if they have the Common Language Runtime (CLR) loaded.(Citation: GitHub SILENTTRINITY Modules July 2019)","relationship_id":"relationship--e0495ed2-62d6-4fd7-9c9b-e57d3c99fd9a","references":[{"source_name":"GitHub SILENTTRINITY Modules July 2019","description":"Salvati, M. (2019, August 6). SILENTTRINITY Modules. Retrieved March 24, 2022.","url":"https://github.com/byt3bl33d3r/SILENTTRINITY/tree/master/silenttrinity/core/teamserver/modules/boo"}]},{"id":"S0693","name":"CaddyWiper","url":"https://attack.mitre.org/software/S0693","kind":"malware","description":"[CaddyWiper](https://attack.mitre.org/software/S0693) can obtain a list of current processes.(Citation: Malwarebytes IssacWiper CaddyWiper March 2022 )","relationship_id":"relationship--ef8d7ed3-805a-4edd-a4e9-74c6520594de","references":[{"source_name":"Malwarebytes IssacWiper CaddyWiper March 2022 ","description":"Threat Intelligence Team. (2022, March 18). Double header: IsaacWiper and CaddyWiper . Retrieved April 11, 2022.","url":"https://blog.malwarebytes.com/threat-intelligence/2022/03/double-header-isaacwiper-and-caddywiper/"}]},{"id":"S0694","name":"DRATzarus","url":"https://attack.mitre.org/software/S0694","kind":"malware","description":"[DRATzarus](https://attack.mitre.org/software/S0694) can enumerate and examine running processes to determine if a debugger is present.(Citation: ClearSky Lazarus Aug 2020)","relationship_id":"relationship--aca452f1-d08e-4975-81b2-e93b56910d67","references":[{"source_name":"ClearSky Lazarus Aug 2020","description":"ClearSky Research Team. (2020, August 13). Operation 'Dream Job' Widespread North Korean Espionage Campaign. Retrieved December 20, 2021.","url":"https://www.clearskysec.com/wp-content/uploads/2020/08/Dream-Job-Campaign.pdf"}]},{"id":"S0695","name":"Donut","url":"https://attack.mitre.org/software/S0695","kind":"tool","description":"[Donut](https://attack.mitre.org/software/S0695) includes subprojects that enumerate and identify information about [Process Injection](https://attack.mitre.org/techniques/T1055) candidates.(Citation: Donut Github)\t","relationship_id":"relationship--59945377-5b77-4267-ae36-9feebccc42f3","references":[{"source_name":"Donut Github","description":"TheWover. (2019, May 9). donut. Retrieved March 25, 2022.","url":"https://github.com/TheWover/donut"}]},{"id":"S0696","name":"Flagpro","url":"https://attack.mitre.org/software/S0696","kind":"malware","description":"[Flagpro](https://attack.mitre.org/software/S0696) has been used to run the <code>tasklist</code> command on a compromised system.(Citation: NTT Security Flagpro new December 2021)","relationship_id":"relationship--f14f7949-81d3-4730-91cf-263ef8487708","references":[{"source_name":"NTT Security Flagpro new December 2021","description":"Hada, H. (2021, December 28).  Flagpro The new malware used by BlackTech. Retrieved March 25, 2022.","url":"https://insight-jp.nttsecurity.com/post/102hf3q/flagpro-the-new-malware-used-by-blacktech"}]},{"id":"S1013","name":"ZxxZ","url":"https://attack.mitre.org/software/S1013","kind":"malware","description":"[ZxxZ](https://attack.mitre.org/software/S1013) has created a snapshot of running processes using `CreateToolhelp32Snapshot`.(Citation: Cisco Talos Bitter Bangladesh May 2022)","relationship_id":"relationship--13a3b832-a680-4c50-b413-c8137a6a89b5","references":[{"source_name":"Cisco Talos Bitter Bangladesh May 2022","description":"Raghuprasad, C . (2022, May 11). Bitter APT adds Bangladesh to their targets. Retrieved June 1, 2022.","url":"https://blog.talosintelligence.com/2022/05/bitter-apt-adds-bangladesh-to-their.html"}]},{"id":"S1016","name":"MacMa","url":"https://attack.mitre.org/software/S1016","kind":"malware","description":"[MacMa](https://attack.mitre.org/software/S1016) can enumerate running processes.(Citation: ESET DazzleSpy Jan 2022)","relationship_id":"relationship--8fbbe6cb-5b2b-433a-9193-7a3890fa3e95","references":[{"source_name":"ESET DazzleSpy Jan 2022","description":"M.Léveillé, M., Cherepanov, A.. (2022, January 25). Watering hole deploys new macOS malware, DazzleSpy, in Asia. Retrieved May 6, 2022.","url":"https://www.welivesecurity.com/2022/01/25/watering-hole-deploys-new-macos-malware-dazzlespy-asia/"}]},{"id":"S1017","name":"OutSteel","url":"https://attack.mitre.org/software/S1017","kind":"malware","description":"[OutSteel](https://attack.mitre.org/software/S1017) can identify running processes on a compromised host.(Citation: Palo Alto Unit 42 OutSteel SaintBot February 2022 )","relationship_id":"relationship--e7cd2966-db55-4214-abcc-78b5bc1e00cd","references":[{"source_name":"Palo Alto Unit 42 OutSteel SaintBot February 2022 ","description":"Unit 42. (2022, February 25). Spear Phishing Attacks Target Organizations in Ukraine, Payloads Include the Document Stealer OutSteel and the Downloader SaintBot. Retrieved June 9, 2022.","url":"https://unit42.paloaltonetworks.com/ukraine-targeted-outsteel-saintbot/"}]},{"id":"S1018","name":"Saint Bot","url":"https://attack.mitre.org/software/S1018","kind":"malware","description":"[Saint Bot](https://attack.mitre.org/software/S1018) has enumerated running processes on a compromised host to determine if it is running under the process name `dfrgui.exe`.(Citation: Palo Alto Unit 42 OutSteel SaintBot February 2022 )","relationship_id":"relationship--bb54d492-228c-4bfe-8e50-9a919067e976","references":[{"source_name":"Palo Alto Unit 42 OutSteel SaintBot February 2022 ","description":"Unit 42. (2022, February 25). Spear Phishing Attacks Target Organizations in Ukraine, Payloads Include the Document Stealer OutSteel and the Downloader SaintBot. Retrieved June 9, 2022.","url":"https://unit42.paloaltonetworks.com/ukraine-targeted-outsteel-saintbot/"}]},{"id":"S1027","name":"Heyoka Backdoor","url":"https://attack.mitre.org/software/S1027","kind":"malware","description":"[Heyoka Backdoor](https://attack.mitre.org/software/S1027) can gather process information.(Citation: SentinelOne Aoqin Dragon June 2022)","relationship_id":"relationship--753edd67-e4bb-4c1c-96bf-4de16c270d8c","references":[{"source_name":"SentinelOne Aoqin Dragon June 2022","description":"Chen, Joey. (2022, June 9). Aoqin Dragon | Newly-Discovered Chinese-linked APT Has Been Quietly Spying On Organizations For 10 Years. Retrieved July 14, 2022.","url":"https://www.sentinelone.com/labs/aoqin-dragon-newly-discovered-chinese-linked-apt-has-been-quietly-spying-on-organizations-for-10-years/"}]},{"id":"S1039","name":"Bumblebee","url":"https://attack.mitre.org/software/S1039","kind":"malware","description":"[Bumblebee](https://attack.mitre.org/software/S1039) can identify processes associated with analytical tools.(Citation: Proofpoint Bumblebee April 2022)(Citation: Symantec Bumblebee June 2022)(Citation: Medium Ali Salem Bumblebee April 2022)","relationship_id":"relationship--c0fc62bc-ac39-4840-968d-8a3f8f3ce6a0","references":[{"source_name":"Symantec Bumblebee June 2022","description":"Kamble, V. (2022, June 28). Bumblebee: New Loader Rapidly Assuming Central Position in Cyber-crime Ecosystem. Retrieved August 24, 2022.","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bumblebee-loader-cybercrime"},{"source_name":"Proofpoint Bumblebee April 2022","description":"Merriman, K. and Trouerbach, P. (2022, April 28). This isn't Optimus Prime's Bumblebee but it's Still Transforming. Retrieved August 22, 2022.","url":"https://www.proofpoint.com/us/blog/threat-insight/bumblebee-is-still-transforming"},{"source_name":"Medium Ali Salem Bumblebee April 2022","description":"Salem, A. (2022, April 27). The chronicles of Bumblebee: The Hook, the Bee, and the Trickbot connection. Retrieved September 2, 2022.","url":"https://elis531989.medium.com/the-chronicles-of-bumblebee-the-hook-the-bee-and-the-trickbot-connection-686379311056"}]},{"id":"S1044","name":"FunnyDream","url":"https://attack.mitre.org/software/S1044","kind":"malware","description":"[FunnyDream](https://attack.mitre.org/software/S1044) has the ability to discover processes, including `Bka.exe` and `BkavUtil.exe`.(Citation: Bitdefender FunnyDream Campaign November 2020)","relationship_id":"relationship--5f7c7285-daa4-499d-b9d6-c1028e5148d4","references":[{"source_name":"Bitdefender FunnyDream Campaign November 2020","description":"Vrabie, V. (2020, November). Dissecting a Chinese APT Targeting South Eastern Asian Government Institutions. Retrieved September 19, 2022.","url":"https://www.bitdefender.com/files/News/CaseStudies/study/379/Bitdefender-Whitepaper-Chinese-APT.pdf"}]},{"id":"S1048","name":"macOS.OSAMiner","url":"https://attack.mitre.org/software/S1048","kind":"malware","description":"[macOS.OSAMiner](https://attack.mitre.org/software/S1048) has used `ps ax | grep <name> | grep -v grep | ...` and `ps ax | grep -E...` to conduct process discovery.(Citation: SentinelLabs reversing run-only applescripts 2021)","relationship_id":"relationship--f1b29d7e-eba7-460a-bcec-33caf6a4fe15","references":[{"source_name":"SentinelLabs reversing run-only applescripts 2021","description":"Phil Stokes. (2021, January 11). FADE DEAD | Adventures in Reversing Malicious Run-Only AppleScripts. Retrieved September 29, 2022.","url":"https://www.sentinelone.com/labs/fade-dead-adventures-in-reversing-malicious-run-only-applescripts/"}]},{"id":"S1050","name":"PcShare","url":"https://attack.mitre.org/software/S1050","kind":"tool","description":"[PcShare](https://attack.mitre.org/software/S1050) can obtain a list of running processes on a compromised host.(Citation: Bitdefender FunnyDream Campaign November 2020)","relationship_id":"relationship--1d6eb87c-6ed9-4432-a51c-b0ef70190120","references":[{"source_name":"Bitdefender FunnyDream Campaign November 2020","description":"Vrabie, V. (2020, November). Dissecting a Chinese APT Targeting South Eastern Asian Government Institutions. Retrieved September 19, 2022.","url":"https://www.bitdefender.com/files/News/CaseStudies/study/379/Bitdefender-Whitepaper-Chinese-APT.pdf"}]},{"id":"S1053","name":"AvosLocker","url":"https://attack.mitre.org/software/S1053","kind":"malware","description":"[AvosLocker](https://attack.mitre.org/software/S1053) has discovered system processes by calling `RmGetList`.(Citation: Malwarebytes AvosLocker Jul 2021)","relationship_id":"relationship--f83fb52a-03f5-4e70-9e08-3365c85c84ba","references":[{"source_name":"Malwarebytes AvosLocker Jul 2021","description":"Hasherezade. (2021, July 23). AvosLocker enters the ransomware scene, asks for partners. Retrieved January 11, 2023.","url":"https://www.malwarebytes.com/blog/threat-intelligence/2021/07/avoslocker-enters-the-ransomware-scene-asks-for-partners"}]},{"id":"S1059","name":"metaMain","url":"https://attack.mitre.org/software/S1059","kind":"malware","description":"[metaMain](https://attack.mitre.org/software/S1059) can enumerate the processes that run on the platform.(Citation: SentinelLabs Metador Sept 2022)(Citation: SentinelLabs Metador Technical Appendix Sept 2022)","relationship_id":"relationship--387d5cbe-8862-45c1-9577-c1424b072283","references":[{"source_name":"SentinelLabs Metador Sept 2022","description":"Ehrlich, A., et al. (2022, September). THE MYSTERY OF METADOR | AN UNATTRIBUTED THREAT HIDING IN TELCOS, ISPS, AND UNIVERSITIES. Retrieved January 23, 2023.","url":"https://assets.sentinelone.com/sentinellabs22/metador#page=1"},{"source_name":"SentinelLabs Metador Technical Appendix Sept 2022","description":"SentinelLabs. (2022, September 22). Metador Technical Appendix. Retrieved April 4, 2023.","url":"https://docs.google.com/document/d/1e9ZTW9b71YwFWS_18ZwDAxa-cYbV8q1wUefmKZLYVsA/edit#heading=h.lmnbtht1ikzm"}]},{"id":"S1060","name":"Mafalda","url":"https://attack.mitre.org/software/S1060","kind":"malware","description":"[Mafalda](https://attack.mitre.org/software/S1060) can enumerate running processes on a machine.(Citation: SentinelLabs Metador Sept 2022)","relationship_id":"relationship--69b6cf6f-f018-4999-b640-fc5a3cb2aa2d","references":[{"source_name":"SentinelLabs Metador Sept 2022","description":"Ehrlich, A., et al. (2022, September). THE MYSTERY OF METADOR | AN UNATTRIBUTED THREAT HIDING IN TELCOS, ISPS, AND UNIVERSITIES. Retrieved January 23, 2023.","url":"https://assets.sentinelone.com/sentinellabs22/metador#page=1"}]},{"id":"S1063","name":"Brute Ratel C4","url":"https://attack.mitre.org/software/S1063","kind":"tool","description":"[Brute Ratel C4](https://attack.mitre.org/software/S1063) can enumerate all processes and locate specific process IDs (PIDs).(Citation: Palo Alto Brute Ratel July 2022)","relationship_id":"relationship--58be00f9-baaf-40d7-973f-3f38bc7322b9","references":[{"source_name":"Palo Alto Brute Ratel July 2022","description":"Harbison, M. and Renals, P. (2022, July 5). When Pentest Tools Go Brutal: Red-Teaming Tool Being Abused by Malicious Actors. Retrieved February 1, 2023.","url":"https://unit42.paloaltonetworks.com/brute-ratel-c4-tool/"}]},{"id":"S1064","name":"SVCReady","url":"https://attack.mitre.org/software/S1064","kind":"malware","description":"[SVCReady](https://attack.mitre.org/software/S1064) can collect a list of running processes from an infected host.(Citation: HP SVCReady Jun 2022)","relationship_id":"relationship--c60fb662-befd-459b-906b-b816b76a727a","references":[{"source_name":"HP SVCReady Jun 2022","description":"Schlapfer, Patrick. (2022, June 6). A New Loader Gets Ready. Retrieved December 13, 2022.","url":"https://threatresearch.ext.hp.com/svcready-a-new-loader-reveals-itself/"}]},{"id":"S1065","name":"Woody RAT","url":"https://attack.mitre.org/software/S1065","kind":"malware","description":"[Woody RAT](https://attack.mitre.org/software/S1065) can call `NtQuerySystemProcessInformation` with `SystemProcessInformation` to enumerate all running processes, including associated information such as PID, parent PID, image name, and owner.(Citation: MalwareBytes WoodyRAT Aug 2022)","relationship_id":"relationship--368510dc-1050-45df-81f2-1fca6118c2b0","references":[{"source_name":"MalwareBytes WoodyRAT Aug 2022","description":"MalwareBytes Threat Intelligence Team. (2022, August 3). Woody RAT: A new feature-rich malware spotted in the wild. Retrieved December 6, 2022.","url":"https://www.malwarebytes.com/blog/threat-intelligence/2022/08/woody-rat-a-new-feature-rich-malware-spotted-in-the-wild"}]},{"id":"S1066","name":"DarkTortilla","url":"https://attack.mitre.org/software/S1066","kind":"malware","description":"[DarkTortilla](https://attack.mitre.org/software/S1066) can enumerate a list of running processes on a compromised system.(Citation: Secureworks DarkTortilla Aug 2022)","relationship_id":"relationship--834c3c4d-b282-47e3-bca9-77f3b17f2f11","references":[{"source_name":"Secureworks DarkTortilla Aug 2022","description":"Secureworks Counter Threat Unit Research Team. (2022, August 17). DarkTortilla Malware Analysis. Retrieved November 3, 2022.","url":"https://www.secureworks.com/research/darktortilla-malware-analysis"}]},{"id":"S1072","name":"Industroyer2","url":"https://attack.mitre.org/software/S1072","kind":"malware","description":"[Industroyer2](https://attack.mitre.org/software/S1072) has the ability to cyclically enumerate running processes such as PServiceControl.exe, PService_PDD.exe, and other targets supplied through a hardcoded configuration.(Citation: Industroyer2 Mandiant April 2022)","relationship_id":"relationship--849c40ae-9dc7-4861-9a6c-8c03b4ffb7b5","references":[{"source_name":"Industroyer2 Mandiant April 2022","description":"Daniel Kapellmann Zafra, Raymond Leong, Chris Sistrunk, Ken Proska, Corey Hildebrandt, Keith Lunden, Nathan Brubaker. (2022, April 25). INDUSTROYER.V2: Old Malware Learns New Tricks. Retrieved March 30, 2023.","url":"https://www.mandiant.com/resources/blog/industroyer-v2-old-malware-new-tricks"}]},{"id":"S1073","name":"Royal","url":"https://attack.mitre.org/software/S1073","kind":"malware","description":"[Royal](https://attack.mitre.org/software/S1073) can use `GetCurrentProcess` to enumerate processes.(Citation: Cybereason Royal December 2022)","relationship_id":"relationship--f0a36615-b3eb-47d5-8a2a-9d7429643a0a","references":[{"source_name":"Cybereason Royal December 2022","description":"Cybereason Global SOC and Cybereason Security Research Teams. (2022, December 14). Royal Rumble: Analysis of Royal Ransomware. Retrieved March 30, 2023.","url":"https://www.cybereason.com/blog/royal-ransomware-analysis"}]},{"id":"S1075","name":"KOPILUWAK","url":"https://attack.mitre.org/software/S1075","kind":"malware","description":"[KOPILUWAK](https://attack.mitre.org/software/S1075) can enumerate current running processes on the targeted machine.(Citation: Mandiant Suspected Turla Campaign February 2023)","relationship_id":"relationship--63cefb36-bc55-4536-b7f9-c80f9e3f69b3","references":[{"source_name":"Mandiant Suspected Turla Campaign February 2023","description":"Hawley, S. et al. (2023, February 2). Turla: A Galaxy of Opportunity. Retrieved May 15, 2023.","url":"https://www.mandiant.com/resources/blog/turla-galaxy-opportunity"}]},{"id":"S1078","name":"RotaJakiro","url":"https://attack.mitre.org/software/S1078","kind":"malware","description":"[RotaJakiro](https://attack.mitre.org/software/S1078) can monitor the `/proc/[PID]` directory of known [RotaJakiro](https://attack.mitre.org/software/S1078) processes as a part of its persistence when executing with non-root permissions. If the process is found dead, it resurrects the process. [RotaJakiro](https://attack.mitre.org/software/S1078) processes can be matched to an associated Advisory Lock, in the `/proc/locks` folder, to ensure it doesn't spawn more than one process.(Citation: RotaJakiro 2021 netlab360 analysis)","relationship_id":"relationship--db219581-f2fc-45f9-846d-c7e6f6d238ce","references":[{"source_name":"RotaJakiro 2021 netlab360 analysis","description":" Alex Turing, Hui Wang. (2021, April 28). RotaJakiro: A long live secret backdoor with 0 VT detection. Retrieved June 14, 2023.","url":"https://blog.netlab.360.com/stealth_rotajakiro_backdoor_en/"}]},{"id":"S1081","name":"BADHATCH","url":"https://attack.mitre.org/software/S1081","kind":"malware","description":"[BADHATCH](https://attack.mitre.org/software/S1081) can retrieve a list of running processes from a compromised machine.(Citation: BitDefender BADHATCH Mar 2021) ","relationship_id":"relationship--2863b77b-a029-4c9e-a573-e5e16d979391","references":[{"source_name":"BitDefender BADHATCH Mar 2021","description":"Vrabie, V., et al. (2021, March 10). FIN8 Returns with Improved BADHATCH Toolkit. Retrieved September 8, 2021.","url":"https://www.bitdefender.com/files/News/CaseStudies/study/394/Bitdefender-PR-Whitepaper-BADHATCH-creat5237-en-EN.pdf"}]},{"id":"S1085","name":"Sardonic","url":"https://attack.mitre.org/software/S1085","kind":"malware","description":"[Sardonic](https://attack.mitre.org/software/S1085) has the ability to execute the `tasklist` command.(Citation: Bitdefender Sardonic Aug 2021)","relationship_id":"relationship--a570d430-29ea-4c89-b25d-1370b44b0e5a","references":[{"source_name":"Bitdefender Sardonic Aug 2021","description":"Budaca, E., et al. (2021, August 25). FIN8 Threat Actor Goes Agile with New Sardonic Backdoor. Retrieved August 9, 2023.","url":"https://www.bitdefender.com/files/News/CaseStudies/study/401/Bitdefender-PR-Whitepaper-FIN8-creat5619-en-EN.pdf"}]},{"id":"S1087","name":"AsyncRAT","url":"https://attack.mitre.org/software/S1087","kind":"tool","description":"[AsyncRAT](https://attack.mitre.org/software/S1087) can examine running processes to determine if a debugger is present.(Citation: Telefonica Snip3 December 2021)","relationship_id":"relationship--d531b421-7347-4dd6-9a98-0b05e6421b40","references":[{"source_name":"Telefonica Snip3 December 2021","description":"Jornet, A. (2021, December 23). Snip3, an investigation into malware. Retrieved September 19, 2023.","url":"https://telefonicatech.com/blog/snip3-investigacion-malware"}]},{"id":"S1090","name":"NightClub","url":"https://attack.mitre.org/software/S1090","kind":"malware","description":"[NightClub](https://attack.mitre.org/software/S1090) has the ability to use `GetWindowThreadProcessId` to identify the process behind a specified window.(Citation: MoustachedBouncer ESET August 2023)","relationship_id":"relationship--c434aa66-8fd2-47f0-8ec4-88a866d99e88","references":[{"source_name":"MoustachedBouncer ESET August 2023","description":"Faou, M. (2023, August 10). MoustachedBouncer: Espionage against foreign diplomats in Belarus. Retrieved September 25, 2023.","url":"https://www.welivesecurity.com/en/eset-research/moustachedbouncer-espionage-against-foreign-diplomats-in-belarus/"}]},{"id":"S1100","name":"Ninja","url":"https://attack.mitre.org/software/S1100","kind":"malware","description":"[Ninja](https://attack.mitre.org/software/S1100) can enumerate processes on a targeted host.(Citation: Kaspersky ToddyCat June 2022)(Citation: Kaspersky ToddyCat Check Logs October 2023)","relationship_id":"relationship--bfa1942d-31b1-454f-b1db-be67550f82ee","references":[{"source_name":"Kaspersky ToddyCat June 2022","description":"Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.","url":"https://securelist.com/toddycat/106799/"},{"source_name":"Kaspersky ToddyCat Check Logs October 2023","description":"Dedola, G. et al. (2023, October 12). ToddyCat: Keep calm and check logs. Retrieved January 3, 2024.","url":"https://securelist.com/toddycat-keep-calm-and-check-logs/110696/"}]},{"id":"S1105","name":"COATHANGER","url":"https://attack.mitre.org/software/S1105","kind":"malware","description":"[COATHANGER](https://attack.mitre.org/software/S1105) will query running process information to determine subsequent program execution flow.(Citation: NCSC-NL COATHANGER Feb 2024)","relationship_id":"relationship--307ae6b5-b4ea-4ef2-bc99-544dbb31cb45","references":[{"source_name":"NCSC-NL COATHANGER Feb 2024","description":"Dutch Military Intelligence and Security Service (MIVD) & Dutch General Intelligence and Security Service (AIVD). (2024, February 6). Ministry of Defense of the Netherlands uncovers COATHANGER, a stealthy Chinese FortiGate RAT. Retrieved February 7, 2024.","url":"https://www.ncsc.nl/binaries/ncsc/documenten/publicaties/2024/februari/6/mivd-aivd-advisory-coathanger-tlp-clear/TLP-CLEAR+MIVD+AIVD+Advisory+COATHANGER.pdf"}]},{"id":"S1107","name":"NKAbuse","url":"https://attack.mitre.org/software/S1107","kind":"malware","description":"[NKAbuse](https://attack.mitre.org/software/S1107) will check victim systems to ensure only one copy of the malware is running.(Citation: NKAbuse SL)","relationship_id":"relationship--19e85b54-a6b4-4141-9284-d405af345372","references":[{"source_name":"NKAbuse SL","description":"KASPERSKY GERT. (2023, December 14). Unveiling NKAbuse: a new multiplatform threat abusing the NKN protocol. Retrieved February 8, 2024.","url":"https://securelist.com/unveiling-nkabuse/111512/"}]},{"id":"S1111","name":"DarkGate","url":"https://attack.mitre.org/software/S1111","kind":"malware","description":"[DarkGate](https://attack.mitre.org/software/S1111) performs various checks for running processes, including security software by looking for hard-coded process name values.(Citation: Ensilo Darkgate 2018)(Citation: Rapid7 BlackBasta 2024) ","relationship_id":"relationship--8b6dec67-2a33-4da7-a2d4-a36ce28cabe8","references":[{"source_name":"Ensilo Darkgate 2018","description":"Adi Zeligson & Rotem Kerner. (2018, November 13). Enter The DarkGate - New Cryptocurrency Mining and Ransomware Campaign. Retrieved February 9, 2024.","url":"https://www.fortinet.com/blog/threat-research/enter-the-darkgate-new-cryptocurrency-mining-and-ransomware-campaign"},{"source_name":"Rapid7 BlackBasta 2024","description":"McGraw, T. (2024, December 4). Black Basta Ransomware Campaign Drops Zbot, DarkGate, and Custom Malware. Retrieved December 9, 2024.","url":"https://www.rapid7.com/blog/post/2024/12/04/black-basta-ransomware-campaign-drops-zbot-darkgate-and-custom-malware/"}]},{"id":"S1114","name":"ZIPLINE","url":"https://attack.mitre.org/software/S1114","kind":"malware","description":"[ZIPLINE](https://attack.mitre.org/software/S1114) can identify running processes and their names.(Citation: Mandiant Cutting Edge January 2024)","relationship_id":"relationship--1c186ff7-913a-46b3-b796-d3445ba0901c","references":[{"source_name":"Mandiant Cutting Edge January 2024","description":"McLellan, T. et al. (2024, January 12). Cutting Edge: Suspected APT Targets Ivanti Connect Secure VPN in New Zero-Day Exploitation. Retrieved February 27, 2024.","url":"https://www.mandiant.com/resources/blog/suspected-apt-targets-ivanti-zero-day"}]},{"id":"S1122","name":"Mispadu","url":"https://attack.mitre.org/software/S1122","kind":"malware","description":"[Mispadu](https://attack.mitre.org/software/S1122) can enumerate the running processes on a compromised host.(Citation: ESET Security Mispadu Facebook Ads 2019)","relationship_id":"relationship--af340193-ba4f-47bf-a610-54235946ee1c","references":[{"source_name":"ESET Security Mispadu Facebook Ads 2019","description":"ESET Security. (2019, November 19). Mispadu: Advertisement for a discounted Unhappy Meal. Retrieved March 13, 2024.","url":"https://www.welivesecurity.com/2019/11/19/mispadu-advertisement-discounted-unhappy-meal/"}]},{"id":"S1124","name":"SocGholish","url":"https://attack.mitre.org/software/S1124","kind":"malware","description":"[SocGholish](https://attack.mitre.org/software/S1124) can list processes on targeted hosts.(Citation: Secureworks Gold Prelude Profile)","relationship_id":"relationship--c052113d-2552-48fc-8deb-d6965d85f547","references":[{"source_name":"Secureworks Gold Prelude Profile","description":"Secureworks. (n.d.). GOLD PRELUDE . Retrieved March 22, 2024.","url":"https://www.secureworks.com/research/threat-profiles/gold-prelude"}]},{"id":"S1129","name":"Akira","url":"https://attack.mitre.org/software/S1129","kind":"malware","description":"[Akira](https://attack.mitre.org/software/S1129) verifies the deletion of volume shadow copies by checking for the existence of the process ID related to the process created to delete these items.(Citation: Kersten Akira 2023)","relationship_id":"relationship--d33b14b1-7501-4bb3-af8c-3e2202fa572f","references":[{"source_name":"Kersten Akira 2023","description":"Max Kersten & Alexandre Mundo. (2023, November 29). Akira Ransomware. Retrieved April 4, 2024.","url":"https://www.trellix.com/blogs/research/akira-ransomware/"}]},{"id":"S1130","name":"Raspberry Robin","url":"https://attack.mitre.org/software/S1130","kind":"malware","description":"[Raspberry Robin](https://attack.mitre.org/software/S1130) can identify processes running on the victim machine, such as security software, during execution.(Citation: TrendMicro RaspberryRobin 2022)(Citation: HP RaspberryRobin 2024)","relationship_id":"relationship--778ab7aa-b85b-4d60-b203-00eff3f4b120","references":[{"source_name":"TrendMicro RaspberryRobin 2022","description":"Christopher So. (2022, December 20). Raspberry Robin Malware Targets Telecom, Governments. Retrieved May 17, 2024.","url":"https://www.trendmicro.com/en_us/research/22/l/raspberry-robin-malware-targets-telecom-governments.html"},{"source_name":"HP RaspberryRobin 2024","description":"Patrick Schläpfer . (2024, April 10). Raspberry Robin Now Spreading Through Windows Script Files. Retrieved May 17, 2024.","url":"https://threatresearch.ext.hp.com/raspberry-robin-now-spreading-through-windows-script-files/"}]},{"id":"S1132","name":"IPsec Helper","url":"https://attack.mitre.org/software/S1132","kind":"malware","description":"[IPsec Helper](https://attack.mitre.org/software/S1132) can identify the process it is currently running under and its number, and pass this back to a command and control node.(Citation: SentinelOne Agrius 2021)","relationship_id":"relationship--24936948-7c46-4c12-a64f-4715ccfb6ffb","references":[{"source_name":"SentinelOne Agrius 2021","description":"Amitai Ben & Shushan Ehrlich. (2021, May). From Wiper to Ransomware: The Evolution of Agrius. Retrieved May 21, 2024.","url":"https://assets.sentinelone.com/sentinellabs/evol-agrius"}]},{"id":"S1133","name":"Apostle","url":"https://attack.mitre.org/software/S1133","kind":"malware","description":"[Apostle](https://attack.mitre.org/software/S1133) retrieves a list of all running processes on a victim host, and stops all services containing the string \"sql,\" likely to propagate ransomware activity to database files.(Citation: SentinelOne Agrius 2021)","relationship_id":"relationship--2693f023-45bc-4244-acf7-a84c91bb4b0b","references":[{"source_name":"SentinelOne Agrius 2021","description":"Amitai Ben & Shushan Ehrlich. (2021, May). From Wiper to Ransomware: The Evolution of Agrius. Retrieved May 21, 2024.","url":"https://assets.sentinelone.com/sentinellabs/evol-agrius"}]},{"id":"S1139","name":"INC Ransomware","url":"https://attack.mitre.org/software/S1139","kind":"malware","description":"[INC Ransomware](https://attack.mitre.org/software/S1139) can use the Microsoft Win32 Restart Manager to kill processes with a specific handle or that are accessing resources it wants to encrypt.(Citation: Cybereason INC Ransomware November 2023)","relationship_id":"relationship--f2a696d7-b929-4307-9f2b-df558a7762cb","references":[{"source_name":"Cybereason INC Ransomware November 2023","description":"Cybereason Security Research Team. (2023, November 20). Threat Alert: INC Ransomware. Retrieved June 5, 2024.","url":"https://web.archive.org/web/20231202022946/https://www.cybereason.com/hubfs/dam/collateral/reports/threat-alert-inc-ransomware.pdf"}]},{"id":"S1141","name":"LunarWeb","url":"https://attack.mitre.org/software/S1141","kind":"malware","description":"[LunarWeb](https://attack.mitre.org/software/S1141) has used shell commands to list running processes.(Citation: ESET Turla Lunar toolset May 2024)","relationship_id":"relationship--8dc84a69-e2d5-4796-a898-0c41202a273f","references":[{"source_name":"ESET Turla Lunar toolset May 2024","description":"Jurčacko, F. (2024, May 15). To the Moon and back(doors): Lunar landing in diplomatic missions. Retrieved June 26, 2024.","url":"https://www.welivesecurity.com/en/eset-research/moon-backdoors-lunar-landing-diplomatic-missions/"}]},{"id":"S1146","name":"MgBot","url":"https://attack.mitre.org/software/S1146","kind":"malware","description":"[MgBot](https://attack.mitre.org/software/S1146) includes a module for establishing a process watchdog for itself, identifying if the [MgBot](https://attack.mitre.org/software/S1146) process is still running.(Citation: Symantec Daggerfly 2023)","relationship_id":"relationship--b1931423-21a7-441b-b0c4-5db519b302ad","references":[{"source_name":"Symantec Daggerfly 2023","description":"Threat Hunter Team. (2023, April 20). Daggerfly: APT Actor Targets Telecoms Company in Africa. Retrieved July 25, 2024.","url":"https://symantec-enterprise-blogs.security.com/threat-intelligence/apt-attacks-telecoms-africa-mgbot"}]},{"id":"S1147","name":"Nightdoor","url":"https://attack.mitre.org/software/S1147","kind":"malware","description":"[Nightdoor](https://attack.mitre.org/software/S1147) can collect information on installed applications via Windows registry keys, as well as collecting information on running processes.(Citation: ESET EvasivePanda 2024)","relationship_id":"relationship--297166d8-036f-4bec-a3bf-acc416427a7f","references":[{"source_name":"ESET EvasivePanda 2024","description":"Ahn Ho, Facundo Muñoz, & Marc-Etienne M.Léveillé. (2024, March 7). Evasive Panda leverages Monlam Festival to target Tibetans. Retrieved July 25, 2024.","url":"https://www.welivesecurity.com/en/eset-research/evasive-panda-leverages-monlam-festival-target-tibetans/"}]},{"id":"S1149","name":"CHIMNEYSWEEP","url":"https://attack.mitre.org/software/S1149","kind":"malware","description":"[CHIMNEYSWEEP](https://attack.mitre.org/software/S1149) can check if a process name contains “creensaver.”(Citation: Mandiant ROADSWEEP August 2022)","relationship_id":"relationship--884e2dbe-6641-400b-93db-2df91ffe5a33","references":[{"source_name":"Mandiant ROADSWEEP August 2022","description":"Jenkins, L. at al. (2022, August 4). ROADSWEEP Ransomware - Likely Iranian Threat Actor Conducts Politically Motivated Disruptive Activity Against Albanian Government Organizations. Retrieved August 6, 2024.","url":"https://cloud.google.com/blog/topics/threat-intelligence/likely-iranian-threat-actor-conducts-politically-motivated-disruptive-activity-against/"}]},{"id":"S1153","name":"Cuckoo Stealer","url":"https://attack.mitre.org/software/S1153","kind":"malware","description":"[Cuckoo Stealer](https://attack.mitre.org/software/S1153) can use `ps aux` to enumerate running processes.(Citation: Kandji Cuckoo April 2024)","relationship_id":"relationship--59984ff6-8907-4f70-b3a7-47d44541e88c","references":[{"source_name":"Kandji Cuckoo April 2024","description":"Kohler, A. and Lopez, C. (2024, April 30). Malware: Cuckoo Behaves Like Cross Between Infostealer and Spyware. Retrieved August 20, 2024.","url":"https://www.kandji.io/blog/malware-cuckoo-infostealer-spyware"}]},{"id":"S1159","name":"DUSTTRAP","url":"https://attack.mitre.org/software/S1159","kind":"malware","description":"[DUSTTRAP](https://attack.mitre.org/software/S1159) can enumerate running processes.(Citation: Google Cloud APT41 2024)","relationship_id":"relationship--4b9ee045-b369-4122-8743-a095f8a90ac5","references":[{"source_name":"Google Cloud APT41 2024","description":"Mike Stokkel et al. (2024, July 18). APT41 Has Arisen From the DUST. Retrieved September 16, 2024.","url":"https://cloud.google.com/blog/topics/threat-intelligence/apt41-arisen-from-dust"}]},{"id":"S1160","name":"Latrodectus","url":"https://attack.mitre.org/software/S1160","kind":"malware","description":"\n[Latrodectus](https://attack.mitre.org/software/S1160) can enumerate running processes including process grandchildren on targeted hosts.(Citation: Latrodectus APR 2024)(Citation: Elastic Latrodectus May 2024)(Citation: Bitsight Latrodectus June 2024)","relationship_id":"relationship--22926f48-80d0-4ce1-8ee0-41a8930b34ef","references":[{"source_name":"Bitsight Latrodectus June 2024","description":"Batista, J. (2024, June 17). Latrodectus, are you coming back?. Retrieved September 13, 2024.","url":"https://www.bitsight.com/blog/latrodectus-are-you-coming-back"},{"source_name":"Latrodectus APR 2024","description":"Proofpoint Threat Research and Team Cymru S2 Threat Research. (2024, April 4). Latrodectus: This Spider Bytes Like Ice . Retrieved May 31, 2024.","url":"https://www.proofpoint.com/us/blog/threat-insight/latrodectus-spider-bytes-ice"},{"source_name":"Elastic Latrodectus May 2024","description":"Stepanic, D. and Bousseaden, S. (2024, May 15). Spring Cleaning with LATRODECTUS: A Potential Replacement for ICEDID. Retrieved September 13, 2024.","url":"https://www.elastic.co/security-labs/spring-cleaning-with-latrodectus"}]},{"id":"S1164","name":"UPSTYLE","url":"https://attack.mitre.org/software/S1164","kind":"malware","description":"[UPSTYLE](https://attack.mitre.org/software/S1164) has the ability to read `/proc/self/cmdline` to see if it is running as a monitored process.(Citation: Palo Alto MidnightEclipse APR 2024)","relationship_id":"relationship--c722836d-2518-4ecb-a0ff-af36e1195d33","references":[{"source_name":"Palo Alto MidnightEclipse APR 2024","description":"Unit 42. (2024, April 12). Threat Brief: Operation MidnightEclipse, Post-Exploitation Activity Related to CVE-2024-3400 . Retrieved January 15, 2025.","url":"https://unit42.paloaltonetworks.com/cve-2024-3400/"}]},{"id":"S1178","name":"ShrinkLocker","url":"https://attack.mitre.org/software/S1178","kind":"malware","description":"[ShrinkLocker](https://attack.mitre.org/software/S1178) checks whether the Bitlocker Drive Encryption Tools service is running.(Citation: Splunk ShrinkLocker 2024)","relationship_id":"relationship--f636aad5-3d15-4e0a-b932-8ff77aab0404","references":[{"source_name":"Splunk ShrinkLocker 2024","description":"Splunk Threat Research Team , Teoderick Contreras. (2024, September 5). ShrinkLocker Malware: Abusing BitLocker to Lock Your Data. Retrieved December 7, 2024.","url":"https://www.splunk.com/en_us/blog/security/shrinklocker-malware-abusing-bitlocker-to-lock-your-data.html"}]},{"id":"S1185","name":"LightSpy","url":"https://attack.mitre.org/software/S1185","kind":"malware","description":"If sent the command `16002`, [LightSpy](https://attack.mitre.org/software/S1185) uses the `NSWorkspace runningApplications()` method to collect the process ID, path to the executable, bundle information, and the filename of the executable for all running applications.(Citation: Huntress LightSpy macOS 2024)","relationship_id":"relationship--23c76193-d7e8-4dca-a9d6-e9b6b0bacfea","references":[{"source_name":"Huntress LightSpy macOS 2024","description":"Stuart Ashenbrenner, Alden Schmidt. (2024, April 25). LightSpy Malware Variant Targeting macOS. Retrieved January 3, 2025.","url":"https://www.huntress.com/blog/lightspy-malware-variant-targeting-macos"}]},{"id":"S1191","name":"Megazord","url":"https://attack.mitre.org/software/S1191","kind":"malware","description":"[Megazord](https://attack.mitre.org/software/S1191) can terminate a list of specified services and processes.(Citation: Palo Alto Howling Scorpius DEC 2024)","relationship_id":"relationship--b418e034-9fdd-4238-8c6a-3ad7bf249ead","references":[{"source_name":"Palo Alto Howling Scorpius DEC 2024","description":"Zemah, Y. (2024, December 2). Threat Assessment: Howling Scorpius (Akira Ransomware). Retrieved January 8, 2025.","url":"https://unit42.paloaltonetworks.com/threat-assessment-howling-scorpius-akira-ransomware/"}]},{"id":"S1199","name":"LockBit 2.0","url":"https://attack.mitre.org/software/S1199","kind":"malware","description":"[LockBit 2.0](https://attack.mitre.org/software/S1199) can determine if a running process has administrative privileges and terminate processes that interfere with encryption or exfiltration.(Citation: FBI Lockbit 2.0 FEB 2022)(Citation: SentinelOne LockBit 2.0)","relationship_id":"relationship--767f436a-6979-456b-8d2d-b8c8a6b86446","references":[{"source_name":"FBI Lockbit 2.0 FEB 2022","description":"FBI. (2022, February 4). Indicators of Compromise Associated with LockBit 2.0 Ransomware. Retrieved January 24, 2025.","url":"https://www.ic3.gov/CSA/2022/220204.pdf"},{"source_name":"SentinelOne LockBit 2.0","description":"SentinelOne. (n.d.). LockBit 2.0: In-Depth Analysis, Detection, Mitigation, and Removal. Retrieved January 24, 2025.","url":"https://www.sentinelone.com/anthology/lockbit-2-0/"}]},{"id":"S1202","name":"LockBit 3.0","url":"https://attack.mitre.org/software/S1202","kind":"malware","description":"[LockBit 3.0](https://attack.mitre.org/software/S1202) can identify and terminate specific services.(Citation: Sentinel Labs LockBit 3.0 JUL 2022)(Citation: Joint Cybersecurity Advisory LockBit JUN 2023)","relationship_id":"relationship--c32cb7ce-20a0-43d9-b600-d44ef0254aa8","references":[{"source_name":"Joint Cybersecurity Advisory LockBit JUN 2023","description":"CISA et al. (2023, June 14). UNDERSTANDING RANSOMWARE THREAT ACTORS: LOCKBIT. Retrieved February 5, 2025.","url":"https://www.cisa.gov/sites/default/files/2023-06/aa23-165a_understanding_TA_LockBit_0.pdf"},{"source_name":"Sentinel Labs LockBit 3.0 JUL 2022","description":"Walter, J. (2022, July 21). LockBit 3.0 Update | Unpicking the Ransomware’s Latest Anti-Analysis and Evasion Techniques. Retrieved February 5, 2025.","url":"https://www.sentinelone.com/labs/lockbit-3-0-update-unpicking-the-ransomwares-latest-anti-analysis-and-evasion-techniques"}]},{"id":"S1210","name":"Sagerunex","url":"https://attack.mitre.org/software/S1210","kind":"malware","description":"[Sagerunex](https://attack.mitre.org/software/S1210) identifies the `explorer.exe` process on the executing system.(Citation: Symantec Bilbug 2022)","relationship_id":"relationship--5cfa8039-2902-436f-aebe-8e085b4b49f1","references":[{"source_name":"Symantec Bilbug 2022","description":"Symntec Threat Hunter Team. (2022, November 12). Billbug: State-sponsored Actor Targets Cert Authority, Government Agencies in Multiple Asian Countries. Retrieved March 15, 2025.","url":"https://www.security.com/threat-intelligence/espionage-asia-governments-cert-authority"}]},{"id":"S1212","name":"RansomHub","url":"https://attack.mitre.org/software/S1212","kind":"malware","description":"[RansomHub](https://attack.mitre.org/software/S1212) can stop processes associated with files currently in use to maximize the impact of encryption.(Citation: CISA RansomHub AUG 2024)","relationship_id":"relationship--a8ef854e-4c3a-4adc-9022-d8d12adc00bb","references":[{"source_name":"CISA RansomHub AUG 2024","description":"CISA et al. (2024, August 29). #StopRansomware: RansomHub Ransomware. Retrieved March 17, 2025.","url":"https://www.cisa.gov/sites/default/files/2024-09/aa24-242a-stopransomware-ransomhub-ransomware_1.pdf"}]},{"id":"S1228","name":"PUBLOAD","url":"https://attack.mitre.org/software/S1228","kind":"malware","description":"[PUBLOAD](https://attack.mitre.org/software/S1228) has used `tasklist` to gather running processes on victim host.(Citation: Trend Micro MUSTANG PANDA PUBLOAD HIUPAN SEPTEMBER 2024) [PUBLOAD](https://attack.mitre.org/software/S1228) has also leveraged the `OpenEventA` Windows API function to check whether the same process was already running.(Citation: 2022 November_TrendMicro_Earth Preta_Toneshell_Pubload) ","relationship_id":"relationship--57391d02-a8bd-432e-866a-6e23e4ac8329","references":[{"source_name":"Trend Micro MUSTANG PANDA PUBLOAD HIUPAN SEPTEMBER 2024","description":"Lenart Bermejo, Sunny Lu, Ted Lee. (2024, September 9). Earth Preta Evolves its Attacks with New Malware and Strategies. Retrieved August 4, 2025.","url":"https://www.trendmicro.com/en_us/research/24/i/earth-preta-new-malware-and-strategies.html"},{"source_name":"2022 November_TrendMicro_Earth Preta_Toneshell_Pubload","description":"Nick Dai, Vickie Su, Sunny Lu. (2022, November 18). Earth Preta Spear-Phishing Governments Worldwide. Retrieved August 4, 2025.","url":"https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html"}]},{"id":"S1229","name":"Havoc","url":"https://attack.mitre.org/software/S1229","kind":"malware","description":"[Havoc](https://attack.mitre.org/software/S1229) can enumerate processes on targeted hosts.(Citation: Havoc Framework Documentation)(Citation: Zscaler Havoc FEB 2023)(Citation: Fortinet Havoc MAR 2025)","relationship_id":"relationship--5046e931-5710-45b4-b5b4-39c58e61d733","references":[{"source_name":"Zscaler Havoc FEB 2023","description":"Shivtarkar, N. and Jain, S. (2023, February 14). Havoc Across the Cyberspace. Retrieved August 4, 2025.","url":"https://www.zscaler.com/blogs/security-research/havoc-across-cyberspace"},{"source_name":"Havoc Framework Documentation","description":"Ungur, P. (n.d.). HAVOC. Retrieved August 4, 2025.","url":"https://havocframework.com/docs/welcome"},{"source_name":"Fortinet Havoc MAR 2025","description":"Wan, Y. (2025, March 3). Havoc: SharePoint with Microsoft Graph API turns into FUD C2. Retrieved August 4, 2025.","url":"https://www.fortinet.com/blog/threat-research/havoc-sharepoint-with-microsoft-graph-api-turns-into-fud-c2"}]},{"id":"S1230","name":"HIUPAN","url":"https://attack.mitre.org/software/S1230","kind":"malware","description":"[HIUPAN](https://attack.mitre.org/software/S1230) has conducted process discovery to identify the [PUBLOAD](https://attack.mitre.org/software/S1228) malware under the process WCBrowserWatcher.exe and will launch it from an install directory if it is not found.(Citation: Trend Micro MUSTANG PANDA PUBLOAD HIUPAN SEPTEMBER 2024)","relationship_id":"relationship--4ecfe8a9-182e-42a7-8b4f-519004185b20","references":[{"source_name":"Trend Micro MUSTANG PANDA PUBLOAD HIUPAN SEPTEMBER 2024","description":"Lenart Bermejo, Sunny Lu, Ted Lee. (2024, September 9). Earth Preta Evolves its Attacks with New Malware and Strategies. Retrieved August 4, 2025.","url":"https://www.trendmicro.com/en_us/research/24/i/earth-preta-new-malware-and-strategies.html"}]},{"id":"S1233","name":"PAKLOG","url":"https://attack.mitre.org/software/S1233","kind":"malware","description":"[PAKLOG](https://attack.mitre.org/software/S1233) has detected and logged the full path of processes active in the foreground using Windows API calls.(Citation: Zscaler PAKLOG CorkLog SplatCloak Splatdropper April 2025)","relationship_id":"relationship--edb14d5c-992a-4cd0-a0f3-b2db3f6b813c","references":[{"source_name":"Zscaler PAKLOG CorkLog SplatCloak Splatdropper April 2025","description":"Sudeep Singh. (2025, April 16). Latest Mustang Panda Arsenal: PAKLOG, CorKLOG, and SplatCloak | P2. Retrieved September 12, 2025.","url":"https://www.zscaler.com/blogs/security-research/latest-mustang-panda-arsenal-paklog-corklog-and-splatcloak-p2"}]},{"id":"S1239","name":"TONESHELL","url":"https://attack.mitre.org/software/S1239","kind":"malware","description":"[TONESHELL](https://attack.mitre.org/software/S1239) has checked the process name and process path to ensure it matches the expected one prior to triggering a custom exception handler.(Citation: 2022 November_TrendMicro_Earth Preta_Toneshell_Pubload) [TONESHELL](https://attack.mitre.org/software/S1239) has also searched for running antivirus processes to include ESET’s antivirus associated executables ekrn.exe and egui.exe.(Citation: Trend Micro Mustang Panda Earth Preta Toneshell February 2025)","relationship_id":"relationship--2c3934ce-291a-41ab-b389-193170f40e36","references":[{"source_name":"Trend Micro Mustang Panda Earth Preta Toneshell February 2025","description":"Nathaniel Morales, Nick Dai. (2025, February 18). Earth Preta Mixes Legitimate and Malicious Components to Sidestep Detection. Retrieved September 10, 2025.","url":"https://www.trendmicro.com/en_us/research/25/b/earth-preta-mixes-legitimate-and-malicious-components-to-sidestep-detection.html"},{"source_name":"2022 November_TrendMicro_Earth Preta_Toneshell_Pubload","description":"Nick Dai, Vickie Su, Sunny Lu. (2022, November 18). Earth Preta Spear-Phishing Governments Worldwide. Retrieved August 4, 2025.","url":"https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html"}]},{"id":"S1242","name":"Qilin","url":"https://attack.mitre.org/software/S1242","kind":"malware","description":"[Qilin](https://attack.mitre.org/software/S1242) can define specific processes to be terminated or left alone at execution.(Citation: Trend Micro Agenda Ransomware AUG 2022)(Citation: SentinelOne Qilin NOV 2022)(Citation: Halcyon Qilin.B OCT 2024)(Citation: HC3 Qilin Threat Profile JUN 2024)(Citation: Trend Micro Agenda Ransomware OCT 2025)(Citation: Cisco Talos Qilin Ransomware OCT 2025)","relationship_id":"relationship--69a36e50-f8a7-4604-8610-d080f8e469d4","references":[{"source_name":"Halcyon Qilin.B OCT 2024","description":"Halcyon RISE Team. (2024, October 24). New Qilin.B Ransomware Variant Boasts Enhanced Encryption and Defense Evasion. Retrieved September 26, 2025.","url":"https://www.halcyon.ai/blog/new-qilin-b-ransomware-variant-boasts-enhanced-encryption-and-defense-evasion"},{"source_name":"HC3 Qilin Threat Profile JUN 2024","description":"Health Sector Cybersecurity Coordination Center. (2024, June 18). Qilin, aka Agenda Ransomware. Retrieved September 26, 2025.","url":"https://www.aha.org/system/files/media/file/2024/06/tlp-clear-hc3-threat-profile-qilin-aka-agenda-ransomware-6-18-2024.pdf"},{"source_name":"Trend Micro Agenda Ransomware AUG 2022","description":"Magdy, S. et al. (2022, August 25). New Golang Ransomware Agenda Customizes Attacks. Retrieved September 26, 2025.","url":"https://www.trendmicro.com/en_us/research/22/h/new-golang-ransomware-agenda-customizes-attacks.html"},{"source_name":"SentinelOne Qilin NOV 2022","description":"SentinelOne. (2022, November 30). Agenda (Qilin). Retrieved September 26, 2025.","url":"https://www.sentinelone.com/anthology/agenda-qilin/"},{"source_name":"Cisco Talos Qilin Ransomware OCT 2025","description":"Takeda, T. et al. (2025, October 26). Uncovering Qilin attack methods exposed through multiple cases. Retrieved March 26, 2026.","url":"https://blog.talosintelligence.com/uncovering-qilin-attack-methods-exposed-through-multiple-cases/"},{"source_name":"Trend Micro Agenda Ransomware OCT 2025","description":"Trend Micro. (2025, October 23). Agenda Ransomware Deploys Linux Variant on Windows Systems Through Remote Management Tools and BYOVD Techniques. Retrieved March 26, 2026.","url":"https://www.trendmicro.com/en_us/research/25/j/agenda-ransomware-deploys-linux-variant-on-windows-systems.html"}]},{"id":"S1244","name":"Medusa Ransomware","url":"https://attack.mitre.org/software/S1244","kind":"malware","description":"[Medusa Ransomware](https://attack.mitre.org/software/S1244) has utilized an encoded list of the processes that it detects and terminates.(Citation: Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024)(Citation: Broadcom Medusa Ransomware Medusa Group March 2025)(Citation: Security Scorecard Medusa Ransomware January 2024)","relationship_id":"relationship--4f368185-2f3f-4a42-b106-707cd476b6b0","references":[{"source_name":"Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024","description":"Anthony Galiette, Doel Santos. (2024, January 11). Medusa Ransomware Turning Your Files into Stone. Retrieved October 15, 2025.","url":"https://unit42.paloaltonetworks.com/medusa-ransomware-escalation-new-leak-site/"},{"source_name":"Broadcom Medusa Ransomware Medusa Group March 2025","description":"Threat Hunter Team Symantec and Carbon Black. (2025, March 6). Medusa Ransomware Activity Continues to Increase. Retrieved October 15, 2025.","url":"https://www.security.com/threat-intelligence/medusa-ransomware-attacks"},{"source_name":"Security Scorecard Medusa Ransomware January 2024","description":"Vlad Pasca. (2024, January 1). A Deep Dive into Medusa Ransomware. Retrieved October 15, 2025.","url":"https://securityscorecard.com/wp-content/uploads/2024/01/deep-dive-into-medusa-ransomware.pdf"}]},{"id":"S1245","name":"InvisibleFerret","url":"https://attack.mitre.org/software/S1245","kind":"malware","description":"[InvisibleFerret](https://attack.mitre.org/software/S1245) has the capability to query installed programs and running processes.(Citation: Zscaler ContagiousInterview BeaverTail InvisibleFerret November 2024) [InvisibleFerret](https://attack.mitre.org/software/S1245) has also identified running processes using the Python project “psutil”.(Citation: PaloAlto ContagiousInterview BeaverTail InvisibleFerret November 2023)","relationship_id":"relationship--624ea031-fa6f-42f6-a3e8-c6ee0063be20","references":[{"source_name":"Zscaler ContagiousInterview BeaverTail InvisibleFerret November 2024","description":"Seongsu Park. (2024, November 4). From Pyongyang to Your Payroll: The Rise of North Korean Remote Workers in the West. Retrieved October 17, 2025.","url":"https://www.zscaler.com/blogs/security-research/pyongyang-your-payroll-rise-north-korean-remote-workers-west"},{"source_name":"PaloAlto ContagiousInterview BeaverTail InvisibleFerret November 2023","description":"Unit 42. (2023, November 21). Hacking Employers and Seeking Employment: Two Job-Related Campaigns Bear Hallmarks of North Korean Threat Actors. Retrieved October 17, 2025.","url":"https://unit42.paloaltonetworks.com/two-campaigns-by-north-korea-bad-actors-target-job-hunters/"}]},{"id":"S1247","name":"Embargo","url":"https://attack.mitre.org/software/S1247","kind":"malware","description":"[Embargo](https://attack.mitre.org/software/S1247) has utilized MS4Killer to detect running processes on the victim device.(Citation: ESET Embargo Ransomware October 2024) [Embargo](https://attack.mitre.org/software/S1247) has also captured a snapshot of active running processes using the Windows API `CreateToolHelp32Snapshot()`.(Citation: Cyble Embargo Ransomware May 2024)","relationship_id":"relationship--53c60fe3-a917-461e-9baa-a268f4a922de","references":[{"source_name":"Cyble Embargo Ransomware May 2024","description":"Cyble. (2024, May 24). The Rust Revolution: New Embargo Ransomware Steps In. Retrieved October 19, 2025.","url":"https://cyble.com/blog/the-rust-revolution-new-embargo-ransomware-steps-in/"},{"source_name":"ESET Embargo Ransomware October 2024","description":"Jan Holman, Tomas Zvara. (2024, October 23). Embargo ransomware: Rock’n’Rust. Retrieved October 19, 2025.","url":"https://www.welivesecurity.com/en/eset-research/embargo-ransomware-rocknrust/"}]},{"id":"S9001","name":"SystemBC","url":"https://attack.mitre.org/software/S9001","kind":"malware","description":"[SystemBC](https://attack.mitre.org/software/S9001) has the ability to enumerate running processes.(Citation: SophosGnGal_SystemBC_Dec2020)  ","relationship_id":"relationship--753c921d-31ab-4a92-8ff9-c1f0b04a13d5","references":[{"source_name":"SophosGnGal_SystemBC_Dec2020","description":"Gallagher, S., Gn, S. (2020, December 16). Ransomware operators use SystemBC RAT as off-the-shelf Tor backdoor. Retrieved May 16, 2025.","url":"https://news.sophos.com/en-us/2020/12/16/systembc/"}]},{"id":"S9012","name":"TRAILBLAZE","url":"https://attack.mitre.org/software/S9012","kind":"malware","description":"[TRAILBLAZE](https://attack.mitre.org/software/S9012) has conducted process discovery by searching for specific named processes such as `/home/bin/web`.(Citation: Google UNC5221 Ivanti April 2025)(Citation: Picus Security UNC5221 Ivanti May 2025)","relationship_id":"relationship--0a7ee066-d242-437c-976d-a59de4dff90e","references":[{"source_name":"Google UNC5221 Ivanti April 2025","description":"John Wolfram, Michael Edie, Jacob Thompson, Matt Lin, Josh Murchie. (2025, April 3). Suspected China-Nexus Threat Actor Actively Exploiting Critical Ivanti Connect Secure Vulnerability (CVE-2025-22457). Retrieved April 13, 2026.","url":"https://cloud.google.com/blog/topics/threat-intelligence/china-nexus-exploiting-critical-ivanti-vulnerability"},{"source_name":"Picus Security UNC5221 Ivanti May 2025","description":"Sila Ozeren Hacioglu. (2025, May 5). UNC5221’s Latest Exploit: Weaponizing CVE-2025-22457 in Ivanti Connect Secure. Retrieved April 13, 2026.","url":"https://www.picussecurity.com/resource/blog/unc5221-cve-2025-22457-ivanti-connect-secure"}]},{"id":"S9015","name":"BRICKSTORM","url":"https://attack.mitre.org/software/S9015","kind":"malware","description":"[BRICKSTORM](https://attack.mitre.org/software/S9015) has the ability to check if it is running as an active child process through the detection of a specific environment variable.(Citation: CISA BRICKSTORM UNC5221 AR25-338A February 2026)","relationship_id":"relationship--59318d61-e9d9-4edc-8965-9d6b1c2e633f","references":[{"source_name":"CISA BRICKSTORM UNC5221 AR25-338A February 2026","description":"DHS/CISA. (2026, February 11). AR25-338A: BRICKSTORM Backdoor. Retrieved April 16, 2026.","url":"https://www.cisa.gov/news-events/analysis-reports/ar25-338a"}]},{"id":"S9019","name":"PureCrypter","url":"https://attack.mitre.org/software/S9019","kind":"malware","description":"[PureCrypter](https://attack.mitre.org/software/S9019) can enumerate processes on compromised hosts.(Citation: Check Point Blind Eagle MAR 2025)","relationship_id":"relationship--0e60931e-34df-4a29-936f-32064ec007c1","references":[{"source_name":"Check Point Blind Eagle MAR 2025","description":"Check Point Research. (2025, March 10). Blind Eagle: …And Justice for All. Retrieved April 16, 2026.","url":"https://research.checkpoint.com/2025/blind-eagle-and-justice-for-all/"}]},{"id":"S9020","name":"LODEINFO","url":"https://attack.mitre.org/software/S9020","kind":"malware","description":"[LODEINFO](https://attack.mitre.org/software/S9020) can kill a process using specific process ID.(Citation: Kaspersky LODEINFO Part II OCT 2022)(Citation: ITOCHU LODEINFO JAN 2024)","relationship_id":"relationship--07e77aac-6518-41d9-9330-7df48651933b","references":[{"source_name":"Kaspersky LODEINFO Part II OCT 2022","description":"Ishimaru, S. (2022, October 31). APT10: Tracking down LODEINFO 2022, part II. Retrieved April 17, 2026.","url":"https://securelist.com/apt10-tracking-down-lodeinfo-2022-part-ii/107745/"},{"source_name":"ITOCHU LODEINFO JAN 2024","description":"ITOCHU. (2024, January 24). The Endless Struggle Against APT10: Insights from LODEINFO v0.6.6 - v0.7.3 Analysis. Retrieved April 17, 2026.","url":"https://blog-en.itochuci.co.jp/entry/2024/01/24/134100"}]},{"id":"S9023","name":"HiddenFace","url":"https://attack.mitre.org/software/S9023","kind":"malware","description":"[HiddenFace](https://attack.mitre.org/software/S9023) can check running processes against a list of blocklisted applications.(Citation: ESET HiddenFace 2024)\n","relationship_id":"relationship--b3b7d3f8-a161-4e47-98d6-090bf128c5a1","references":[{"source_name":"ESET HiddenFace 2024","description":"Breitenbacher, D. (2024). Unmasking HiddenFace. Retrieved April 17, 2026.","url":"https://jsac.jpcert.or.jp/archive/2024/pdf/JSAC2024_2_8_Breitenbacher_en.pdf"}]},{"id":"S9024","name":"SPAWNCHIMERA","url":"https://attack.mitre.org/software/S9024","kind":"malware","description":"[SPAWNCHIMERA](https://attack.mitre.org/software/S9024) has searched for running processes to include web or dsmdm.(Citation: CISA SPAWNCHIMERA RESURGE February 2026)(Citation: Google UNC5221 BRICKSTORM SPAWNCHIMERA April 2024)","relationship_id":"relationship--029f4f57-f14b-47c3-9c34-afe3c2e465ae","references":[{"source_name":"CISA SPAWNCHIMERA RESURGE February 2026","description":"DHS/CISA. (2026, February 26). MAR-25993211-r1.v2 Ivanti Connect Secure (RESURGE): AR25-087A. Retrieved April 17, 2026.","url":"https://www.cisa.gov/news-events/analysis-reports/ar25-087a"},{"source_name":"Google UNC5221 BRICKSTORM SPAWNCHIMERA April 2024","description":"Matt Lin, Austin Larsen, John Wolfram, Ashley Pearson, Josh Murchie, Lukasz Lamparski, Joseph Pisano, Ryan Hall, Ron Craft, Shawn Crew, Billy Wong, Tyler McLellan. (2024, April 4). Cutting Edge, Part 4: Ivanti Connect Secure VPN Post-Exploitation Lateral Movement Case Studies. Retrieved April 16, 2026.","url":"https://cloud.google.com/blog/topics/threat-intelligence/ivanti-post-exploitation-lateral-movement"}]},{"id":"S9031","name":"AshTag","url":"https://attack.mitre.org/software/S9031","kind":"malware","description":"The [AshTag](https://attack.mitre.org/software/S9031) AshenOrchestrator component has process management functionality.(Citation: Palo Alto Ashen Lepus DEC 2025)","relationship_id":"relationship--dd78a0f9-98c4-4074-8fce-4bef68d53f14","references":[{"source_name":"Palo Alto Ashen Lepus DEC 2025","description":"Unit 42. (2025, December 11). Hamas-Affiliated Ashen Lepus Targets Middle Eastern Diplomatic Entities With New AshTag Malware Suite. Retrieved April 20, 2026.","url":"https://unit42.paloaltonetworks.com/hamas-affiliate-ashen-lepus-uses-new-malware-suite-ashtag/"}]},{"id":"S9032","name":"MuddyViper","url":"https://attack.mitre.org/software/S9032","kind":"malware","description":"[MuddyViper](https://attack.mitre.org/software/S9032) has the ability to collect running processes.(Citation: ESET_MuddyWater_Dec2025)    ","relationship_id":"relationship--5f387fdf-8d1f-4098-864c-c674277ad9da","references":[{"source_name":"ESET_MuddyWater_Dec2025","description":"ESET Research. (2025, December 2). MuddyWater: Snakes by the riverbank. Retrieved February 17, 2026.","url":"https://www.welivesecurity.com/en/eset-research/muddywater-snakes-riverbank/"}]},{"id":"S9035","name":"LAMEHUG","url":"https://attack.mitre.org/software/S9035","kind":"malware","description":"[LAMEHUG](https://attack.mitre.org/software/S9035) can gather process information on targeted systems.(Citation: Nov AI Threat Tracker)(Citation: Cato LAMEHUG JUL 2025)","relationship_id":"relationship--903b7f1b-48e2-4f01-a9e5-454cb2c8ccb7","references":[{"source_name":"Nov AI Threat Tracker","description":"Google Threat Intelligence Group. (2025, November 5). GTIG AI Threat Tracker: Advances in Threat Actor Usage of AI Tools. Retrieved March 31, 2026.","url":"https://cloud.google.com/blog/topics/threat-intelligence/threat-actor-usage-of-ai-tools"},{"source_name":"Cato LAMEHUG JUL 2025","description":"Simonovich, V. (2025, July 23). Cato CTRL™ Threat Research: Analyzing LAMEHUG – First Known LLM-Powered Malware with Links to APT28 (Fancy Bear) . Retrieved April 21, 2026.","url":"https://www.catonetworks.com/blog/cato-ctrl-threat-research-analyzing-lamehug/"}]},{"id":"S9036","name":"LP-Notes","url":"https://attack.mitre.org/software/S9036","kind":"malware","description":"[LP-Notes](https://attack.mitre.org/software/S9036) has searched for the process taskhostw.exe.(Citation: ESET_MuddyWater_Dec2025)","relationship_id":"relationship--d0a7119c-b59c-491a-bd02-f8f8733e0302","references":[{"source_name":"ESET_MuddyWater_Dec2025","description":"ESET Research. (2025, December 2). MuddyWater: Snakes by the riverbank. Retrieved February 17, 2026.","url":"https://www.welivesecurity.com/en/eset-research/muddywater-snakes-riverbank/"}]},{"id":"S9041","name":"TeamPCP Cloud Stealer","url":"https://attack.mitre.org/software/S9041","kind":"malware","description":"[TeamPCP Cloud Stealer](https://attack.mitre.org/software/S9041) can locate GitHub Actions runner processes.(Citation: Aqua Security Blog Trivy Compromise APR 2026)(Citation: Wiz Trivy Compromise MAR 2026)(Citation: Aqua Security Trivy Compromise MAR 2026)(Citation: Wiz TeamPCP KICS MAR 2026)","relationship_id":"relationship--2f5a0454-031c-49e0-979e-c38f4cc4bbcc","references":[{"source_name":"Aqua Security Trivy Compromise MAR 2026","description":"Aqua Security . (2026, March 21). Trivy ecosystem supply chain temporarily compromised. Retrieved July 1, 2026.","url":"https://github.com/aquasecurity/trivy/security/advisories/GHSA-69fq-xp46-6x23"},{"source_name":"Aqua Security Blog Trivy Compromise APR 2026","description":"Aqua Team. (2026, April 1). Update: Ongoing Investigation and Continued Remediation. Retrieved July 1, 2026.","url":"https://www.aquasec.com/blog/trivy-supply-chain-attack-what-you-need-to-know"},{"source_name":"Wiz Trivy Compromise MAR 2026","description":"McCarthy, R. (2026, March 20). Trivy Compromised: Everything You Need to Know about the Latest Supply Chain Attack. Retrieved July 1, 2026.","url":"https://www.wiz.io/blog/trivy-compromised-teampcp-supply-chain-attack"},{"source_name":"Wiz TeamPCP KICS MAR 2026","description":"McCarthy, R., Haughom, J., Read, B. (2026, March 23). KICS GitHub Action Compromised: TeamPCP Strikes Again in Supply Chain Attack. Retrieved July 1, 2026.","url":"https://www.wiz.io/blog/teampcp-attack-kics-github-action"}]},{"id":"S9045","name":"BACKUPOSINT v9.0 APEX PREDATOR","url":"https://attack.mitre.org/software/S9045","kind":"malware","description":"[BACKUPOSINT v9.0 APEX PREDATOR](https://attack.mitre.org/software/S9045) has the ability to enumerate the processes running within the victim environment.(Citation: AI-Mexico-Govt-Breach) ","relationship_id":"relationship--38215713-5226-4adf-899f-a0017fb133ed","references":[{"source_name":"AI-Mexico-Govt-Breach","description":"Eyal Sela. (2026, April). The AI-Assisted Breach of Mexico's Government Infrastructure. Retrieved September 2, 2026.","url":"https://cdn.prod.website-files.com/69944dd945f20ca4a27a7c47/69d8bb5aea59e31efb3b8a7f_Tech_Report_ai_breach_mex_gov.pdf"}]},{"id":"S9050","name":"Vidar","url":"https://attack.mitre.org/software/S9050","kind":"malware","description":"[Vidar](https://attack.mitre.org/software/S9050) has used the functions `GetCurrentProcess` and `GetCurrentProcessId` to obtain information about processes.(Citation: Cyfirma_Vidar_June2024)","relationship_id":"relationship--ff9ae60d-7d27-4fa9-9019-3f906307ec1d","references":[{"source_name":"Cyfirma_Vidar_June2024","description":"CYFIRMA. (2024, June 3). Vidar Stealer: An In-depth Analysis of an Information-Stealing Malware. Retrieved August 13, 2026.","url":"https://www.cyfirma.com/research/vidar-stealer-an-in-depth-analysis-of-an-information-stealing-malware/"}]},{"id":"S9052","name":"MiniFast","url":"https://attack.mitre.org/software/S9052","kind":"malware","description":"[MiniFast](https://attack.mitre.org/software/S9052) has the ability to check running processes and has returned process names and their PIDs. [MiniFast](https://attack.mitre.org/software/S9052) has also checked its relative parent process.(Citation: CheckPoint_NimbusManticore_May2026) ","relationship_id":"relationship--8895b1a0-d48f-4869-9f3a-19255c3bc490","references":[{"source_name":"CheckPoint_NimbusManticore_May2026","description":"Check Point. (2026, May 22). Fast and Furious – Nimbus Manticore Operations During the Iranian Conflict. Retrieved September 23, 2026.","url":"https://research.checkpoint.com/2026/fast-and-furious-nimbus-manticore-operations-during-the-iranian-conflict/"}]},{"id":"S9053","name":"MiniJunk","url":"https://attack.mitre.org/software/S9053","kind":"malware","description":"[MiniJunk](https://attack.mitre.org/software/S9053) has the ability to validate running processes.(Citation: CheckPoint_NimbusManticoreEurope_Sept2025) ","relationship_id":"relationship--df83b388-66bd-4504-a051-7a7800a8e5cb","references":[{"source_name":"CheckPoint_NimbusManticoreEurope_Sept2025","description":"Check Point. (2025, September 22). Nimbus Manticore Deploys New Malware Targeting Europe. Retrieved September 24, 2026.","url":"https://research.checkpoint.com/2025/nimbus-manticore-deploys-new-malware-targeting-europe/"}]},{"id":"S9060","name":"MiniBus","url":"https://attack.mitre.org/software/S9060","kind":"malware","description":"[MiniBus](https://attack.mitre.org/software/S9060) has the ability to identify running processes.(Citation: Mandiant_UNC1549_Feb2024)","relationship_id":"relationship--872394be-9a8e-4888-8c7b-24b8b84f24c6","references":[{"source_name":"Mandiant_UNC1549_Feb2024","description":"Rozmann, O., et al. (2024, February 27). When Cats Fly: Suspected Iranian Threat Actor UNC1549 Targets Israeli and Middle East Aerospace and Defense Sectors. Retrieved September 28, 2026.","url":"https://cloud.google.com/blog/topics/threat-intelligence/suspected-iranian-unc1549-targets-israel-middle-east"}]}],"actors":[{"id":"G0004","name":"Ke3chang","url":"https://attack.mitre.org/groups/G0004","kind":"intrusion-set","description":"[Ke3chang](https://attack.mitre.org/groups/G0004) performs process discovery using <code>tasklist</code> commands.(Citation: Mandiant Operation Ke3chang November 2014)(Citation: NCC Group APT15 Alive and Strong)","relationship_id":"relationship--c7e6d4a6-8d99-4134-848a-f4f712eb4316","references":[{"source_name":"Mandiant Operation Ke3chang November 2014","description":"Villeneuve, N., Bennett, J. T., Moran, N., Haq, T., Scott, M., & Geers, K. (2014). OPERATION “KE3CHANG”: Targeted Attacks Against Ministries of Foreign Affairs. Retrieved November 12, 2014.","url":"https://www.mandiant.com/resources/operation-ke3chang-targeted-attacks-against-ministries-of-foreign-affairs"},{"source_name":"NCC Group APT15 Alive and Strong","description":"Smallridge, R. (2018, March 10). APT15 is alive and strong: An analysis of RoyalCli and RoyalDNS. Retrieved April 4, 2018.","url":"https://research.nccgroup.com/2018/03/10/apt15-is-alive-and-strong-an-analysis-of-royalcli-and-royaldns/"}]},{"id":"G0006","name":"APT1","url":"https://attack.mitre.org/groups/G0006","kind":"intrusion-set","description":"[APT1](https://attack.mitre.org/groups/G0006) gathered a list of running processes on the system using <code>tasklist /v</code>.(Citation: Mandiant APT1)","relationship_id":"relationship--38416e2a-3590-4827-9a6f-d8f1df6568af","references":[{"source_name":"Mandiant APT1","description":"Mandiant. (n.d.). APT1 Exposing One of China’s Cyber Espionage Units. Retrieved July 18, 2016.","url":"https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf"}]},{"id":"G0007","name":"APT28","url":"https://attack.mitre.org/groups/G0007","kind":"intrusion-set","description":"An [APT28](https://attack.mitre.org/groups/G0007) loader Trojan will enumerate the victim's processes searching for explorer.exe if its current process does not have necessary permissions.(Citation: Unit 42 Playbook Dec 2017)","relationship_id":"relationship--51d06864-d5de-4286-b2bb-561a8d2c4d49","references":[{"source_name":"Unit 42 Playbook Dec 2017","description":"Unit 42. (2017, December 15). Unit 42 Playbook Viewer. Retrieved December 20, 2017.","url":"https://web.archive.org/web/20230702043312/https://pan-unit42.github.io/playbook_viewer/"}]},{"id":"G0009","name":"Deep Panda","url":"https://attack.mitre.org/groups/G0009","kind":"intrusion-set","description":"[Deep Panda](https://attack.mitre.org/groups/G0009) uses the Microsoft [Tasklist](https://attack.mitre.org/software/S0057) utility to list processes running on systems.(Citation: Alperovitch 2014)","relationship_id":"relationship--1fbf92c8-747b-4c0f-ab33-ce63cbff8197","references":[{"source_name":"Alperovitch 2014","description":"Alperovitch, D. (2014, July 7). Deep in Thought: Chinese Targeting of National Security Think Tanks. Retrieved November 12, 2014.","url":"https://web.archive.org/web/20200424075623/https:/www.crowdstrike.com/blog/deep-thought-chinese-targeting-national-security-think-tanks/"}]},{"id":"G0010","name":"Turla","url":"https://attack.mitre.org/groups/G0010","kind":"intrusion-set","description":"[Turla](https://attack.mitre.org/groups/G0010) surveys a system upon check-in to discover running processes using the <code>tasklist /v</code> command.(Citation: Kaspersky Turla) [Turla](https://attack.mitre.org/groups/G0010) RPC backdoors have also enumerated processes associated with specific open ports or named pipes.(Citation: ESET Turla PowerShell May 2019)","relationship_id":"relationship--9dfb7899-20af-4eea-bfca-f608d885cb00","references":[{"source_name":"Kaspersky Turla","description":"Kaspersky Lab's Global Research and Analysis Team. (2014, August 7). The Epic Turla Operation: Solving some of the mysteries of Snake/Uroburos. Retrieved December 11, 2014.","url":"https://securelist.com/the-epic-turla-operation/65545/"},{"source_name":"ESET Turla PowerShell May 2019","description":"Faou, M. and Dumont R.. (2019, May 29). A dive into Turla PowerShell usage. Retrieved June 14, 2019.","url":"https://www.welivesecurity.com/2019/05/29/turla-powershell-usage/"}]},{"id":"G0012","name":"Darkhotel","url":"https://attack.mitre.org/groups/G0012","kind":"intrusion-set","description":"[Darkhotel](https://attack.mitre.org/groups/G0012) malware can collect a list of running processes on a system.(Citation: Securelist Darkhotel Aug 2015)","relationship_id":"relationship--48649215-087c-4ded-925c-f2c3f57dcba1","references":[{"source_name":"Securelist Darkhotel Aug 2015","description":"Kaspersky Lab's Global Research & Analysis Team. (2015, August 10). Darkhotel's attacks in 2015. Retrieved November 2, 2018.","url":"https://securelist.com/darkhotels-attacks-in-2015/71713/"}]},{"id":"G0021","name":"Molerats","url":"https://attack.mitre.org/groups/G0021","kind":"intrusion-set","description":"[Molerats](https://attack.mitre.org/groups/G0021) actors obtained a list of active processes on the victim and sent them to C2 servers.(Citation: DustySky)","relationship_id":"relationship--6e757efa-8231-4674-a1ea-e234e2dfb838","references":[{"source_name":"DustySky","description":"ClearSky. (2016, January 7). Operation DustySky. Retrieved January 8, 2016.","url":"https://www.clearskysec.com/wp-content/uploads/2016/01/Operation%20DustySky_TLP_WHITE.pdf"}]},{"id":"G0022","name":"APT3","url":"https://attack.mitre.org/groups/G0022","kind":"intrusion-set","description":"[APT3](https://attack.mitre.org/groups/G0022) has a tool that can list out currently running processes.(Citation: FireEye Clandestine Fox)(Citation: evolution of pirpi)","relationship_id":"relationship--daf56e8e-ea82-4ef2-bb03-78dd7e6ef3c0","references":[{"source_name":"FireEye Clandestine Fox","description":"Chen, X., Scott, M., Caselden, D.. (2014, April 26). New Zero-Day Exploit targeting Internet Explorer Versions 9 through 11 Identified in Targeted Attacks. Retrieved January 14, 2016.","url":"https://www.fireeye.com/blog/threat-research/2014/04/new-zero-day-exploit-targeting-internet-explorer-versions-9-through-11-identified-in-targeted-attacks.html"},{"source_name":"evolution of pirpi","description":"Yates, M. (2017, June 18). APT3 Uncovered: The code evolution of Pirpi. Retrieved September 28, 2017.","url":"https://recon.cx/2017/montreal/resources/slides/RECON-MTL-2017-evolution_of_pirpi.pdf"}]},{"id":"G0032","name":"Lazarus Group","url":"https://attack.mitre.org/groups/G0032","kind":"intrusion-set","description":"Several [Lazarus Group](https://attack.mitre.org/groups/G0032) malware families gather a list of running processes on a victim system and send it to their C2 server. A Destover-like variant used by [Lazarus Group](https://attack.mitre.org/groups/G0032) also gathers process times.(Citation: Novetta Blockbuster)(Citation: Novetta Blockbuster Loaders)(Citation: McAfee Lazarus Resurfaces Feb 2018)(Citation: McAfee GhostSecret)(Citation: TrendMicro macOS Dacls May 2020)(Citation: Lazarus APT January 2022)","relationship_id":"relationship--699ddfef-6e95-42cf-b212-dc661f790adc","references":[{"source_name":"TrendMicro macOS Dacls May 2020","description":"Mabutas, G. (2020, May 11). New MacOS Dacls RAT Backdoor Shows Lazarus’ Multi-Platform Attack Capability. Retrieved August 10, 2020.","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/new-macos-dacls-rat-backdoor-show-lazarus-multi-platform-attack-capability/"},{"source_name":"Novetta Blockbuster Loaders","description":"Novetta Threat Research Group. (2016, February 24). Operation Blockbuster: Loaders, Installers and Uninstallers Report. Retrieved November 17, 2024.","url":"https://web.archive.org/web/20190508165631/https://operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Loaders-Installers-and-Uninstallers-Report.pdf"},{"source_name":"Novetta Blockbuster","description":"Novetta Threat Research Group. (2016, February 24). Operation Blockbuster: Unraveling the Long Thread of the Sony Attack. Retrieved February 25, 2016.","url":"https://web.archive.org/web/20160226161828/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf"},{"source_name":"Lazarus APT January 2022","description":"Saini, A. and Hossein, J. (2022, January 27). North Korea’s Lazarus APT leverages Windows Update client, GitHub in latest campaign. Retrieved January 27, 2022.","url":"https://blog.malwarebytes.com/threat-intelligence/2022/01/north-koreas-lazarus-apt-leverages-windows-update-client-github-in-latest-campaign/"},{"source_name":"McAfee Lazarus Resurfaces Feb 2018","description":"Sherstobitoff, R. (2018, February 12). Lazarus Resurfaces, Targets Global Banks and Bitcoin Users. Retrieved February 19, 2018.","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/lazarus-resurfaces-targets-global-banks-bitcoin-users/"},{"source_name":"McAfee GhostSecret","description":"Sherstobitoff, R., Malhotra, A. (2018, April 24). Analyzing Operation GhostSecret: Attack Seeks to Steal Data Worldwide. Retrieved May 16, 2018.","url":"https://securingtomorrow.mcafee.com/mcafee-labs/analyzing-operation-ghostsecret-attack-seeks-to-steal-data-worldwide/"}]},{"id":"G0033","name":"Poseidon Group","url":"https://attack.mitre.org/groups/G0033","kind":"intrusion-set","description":"After compromising a victim, [Poseidon Group](https://attack.mitre.org/groups/G0033) lists all running processes.(Citation: Kaspersky Poseidon Group)","relationship_id":"relationship--c6f81350-a410-4ac7-a4b0-58bd4a9c1d9e","references":[{"source_name":"Kaspersky Poseidon Group","description":"Kaspersky Lab's Global Research and Analysis Team. (2016, February 9). Poseidon Group: a Targeted Attack Boutique specializing in global cyber-espionage. Retrieved March 16, 2016.","url":"https://securelist.com/poseidon-group-a-targeted-attack-boutique-specializing-in-global-cyber-espionage/73673/"}]},{"id":"G0038","name":"Stealth Falcon","url":"https://attack.mitre.org/groups/G0038","kind":"intrusion-set","description":"[Stealth Falcon](https://attack.mitre.org/groups/G0038) malware gathers a list of running processes.(Citation: Citizen Lab Stealth Falcon May 2016)","relationship_id":"relationship--4de2ac9b-4e51-4d73-8fe3-d7d1659778b8","references":[{"source_name":"Citizen Lab Stealth Falcon May 2016","description":"Marczak, B. and Scott-Railton, J.. (2016, May 29). Keep Calm and (Don’t) Enable Macros: A New Threat Actor Targets UAE Dissidents. Retrieved June 8, 2016.","url":"https://citizenlab.org/2016/05/stealth-falcon/"}]},{"id":"G0044","name":"Winnti Group","url":"https://attack.mitre.org/groups/G0044","kind":"intrusion-set","description":"[Winnti Group](https://attack.mitre.org/groups/G0044) looked for a specific process running on infected servers.(Citation: Kaspersky Winnti April 2013)","relationship_id":"relationship--e8cb4430-db05-4029-b011-926a2ba17a4c","references":[{"source_name":"Kaspersky Winnti April 2013","description":"Kaspersky Lab's Global Research and Analysis Team. (2013, April 11). Winnti. More than just a game. Retrieved February 8, 2017.","url":"https://securelist.com/winnti-more-than-just-a-game/37029/"}]},{"id":"G0046","name":"FIN7","url":"https://attack.mitre.org/groups/G0046","kind":"intrusion-set","description":"[FIN7](https://attack.mitre.org/groups/G0046) has used the PowerShell script 3CF9.ps1 to perform process discovery by executing `tasklist /v`. Additionally, WsTaskLoad.exe executes `tasklist /v` to perform process discovery.(Citation: BlackBerry_FIN7_April2024)  ","relationship_id":"relationship--9ba9eff2-1471-4395-a2ed-2187aabd893b","references":[{"source_name":"BlackBerry_FIN7_April2024","description":" The BlackBerry Research and Intelligence Team. (2024, April 17). Threat Group FIN7 Targets the U.S. Automotive Industry. Retrieved May 1, 2025.","url":"https://blogs.blackberry.com/en/2024/04/fin7-targets-the-united-states-automotive-industry"}]},{"id":"G0047","name":"Gamaredon Group","url":"https://attack.mitre.org/groups/G0047","kind":"intrusion-set","description":"[Gamaredon Group](https://attack.mitre.org/groups/G0047) has used tools to enumerate processes on target hosts including Process Explorer.(Citation: Symantec Shuckworm January 2022)(Citation: Unit 42 Gamaredon February 2022)(Citation: SymantecCarbonBlack_ShuckwormUSB_Apr2025)","relationship_id":"relationship--dfe4c167-8e69-4b15-912f-ccd437674423","references":[{"source_name":"Symantec Shuckworm January 2022","description":"Symantec. (2022, January 31). Shuckworm Continues Cyber-Espionage Attacks Against Ukraine. Retrieved February 17, 2022.","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/shuckworm-gamaredon-espionage-ukraine"},{"source_name":"SymantecCarbonBlack_ShuckwormUSB_Apr2025","description":"Threat Hunter Team, Symantec and Carbon Black. (2025, April 10). Shuckworm Targets Foreign Military Mission Based in Ukraine. Retrieved July 23, 2025.","url":"https://www.security.com/threat-intelligence/shuckworm-ukraine-gammasteel"},{"source_name":"Unit 42 Gamaredon February 2022","description":"Unit 42. (2022, February 3). Russia’s Gamaredon aka Primitive Bear APT Group Actively Targeting Ukraine. Retrieved February 21, 2022.","url":"https://unit42.paloaltonetworks.com/gamaredon-primitive-bear-ukraine-update-2021/"}]},{"id":"G0049","name":"OilRig","url":"https://attack.mitre.org/groups/G0049","kind":"intrusion-set","description":"[OilRig](https://attack.mitre.org/groups/G0049) has run <code>tasklist</code> on a victim's machine and used infostealers to capture processes.(Citation: Palo Alto OilRig May 2016)(Citation: Symantec Crambus OCT 2023)","relationship_id":"relationship--d8e375a3-f455-4c66-bc63-251f320ec8b1","references":[{"source_name":"Palo Alto OilRig May 2016","description":"Falcone, R. and Lee, B.. (2016, May 26). The OilRig Campaign: Attacks on Saudi Arabian Organizations Deliver Helminth Backdoor. Retrieved May 3, 2017.","url":"http://researchcenter.paloaltonetworks.com/2016/05/the-oilrig-campaign-attacks-on-saudi-arabian-organizations-deliver-helminth-backdoor/"},{"source_name":"Symantec Crambus OCT 2023","description":"Symantec Threat Hunter Team. (2023, October 19). Crambus: New Campaign Targets Middle Eastern Government. Retrieved November 27, 2024.","url":"https://www.security.com/threat-intelligence/crambus-middle-east-government"}]},{"id":"G0059","name":"Magic Hound","url":"https://attack.mitre.org/groups/G0059","kind":"intrusion-set","description":"[Magic Hound](https://attack.mitre.org/groups/G0059) malware can list running processes.(Citation: Unit 42 Magic Hound Feb 2017)","relationship_id":"relationship--a4c59c09-2abd-4c49-8156-0ccc9214b66e","references":[{"source_name":"Unit 42 Magic Hound Feb 2017","description":"Lee, B. and Falcone, R. (2017, February 15). Magic Hound Campaign Attacks Saudi Targets. Retrieved December 27, 2017.","url":"https://researchcenter.paloaltonetworks.com/2017/02/unit42-magic-hound-campaign-attacks-saudi-targets/"}]},{"id":"G0067","name":"APT37","url":"https://attack.mitre.org/groups/G0067","kind":"intrusion-set","description":"[APT37](https://attack.mitre.org/groups/G0067)'s Freenki malware lists running processes using the Microsoft Windows API.(Citation: Talos Group123)","relationship_id":"relationship--a9b92f28-c273-48cf-8ee6-dfa6c240cda9","references":[{"source_name":"Talos Group123","description":"Mercer, W., Rascagneres, P. (2018, January 16). Korea In The Crosshairs. Retrieved May 21, 2018.","url":"https://blog.talosintelligence.com/2018/01/korea-in-crosshairs.html"}]},{"id":"G0069","name":"MuddyWater","url":"https://attack.mitre.org/groups/G0069","kind":"intrusion-set","description":"[MuddyWater](https://attack.mitre.org/groups/G0069) has used malware to obtain a list of running processes on the system.(Citation: Securelist MuddyWater Oct 2018)(Citation: ClearSky MuddyWater June 2019)","relationship_id":"relationship--9f81120a-adde-47cc-95bc-cd8201eb0a11","references":[{"source_name":"Securelist MuddyWater Oct 2018","description":"Kaspersky Lab's Global Research & Analysis Team. (2018, October 10). MuddyWater expands operations. Retrieved November 2, 2018.","url":"https://securelist.com/muddywater/88059/"},{"source_name":"ClearSky MuddyWater June 2019","description":"ClearSky. (2019, June). Iranian APT group ‘MuddyWater’ Adds Exploits to Their Arsenal. Retrieved May 14, 2020.","url":"https://www.clearskysec.com/wp-content/uploads/2019/06/Clearsky-Iranian-APT-group-%E2%80%98MuddyWater%E2%80%99-Adds-Exploits-to-Their-Arsenal.pdf"}]},{"id":"G0081","name":"Tropic Trooper","url":"https://attack.mitre.org/groups/G0081","kind":"intrusion-set","description":"[Tropic Trooper](https://attack.mitre.org/groups/G0081) is capable of enumerating the running processes on the system using <code>pslist</code>.(Citation: Unit 42 Tropic Trooper Nov 2016)(Citation: TrendMicro Tropic Trooper May 2020)","relationship_id":"relationship--17cafa26-57f1-4efb-9d23-1399cd2de4cd","references":[{"source_name":"Unit 42 Tropic Trooper Nov 2016","description":"Ray, V. (2016, November 22). Tropic Trooper Targets Taiwanese Government and Fossil Fuel Provider With Poison Ivy. Retrieved November 9, 2018.","url":"https://researchcenter.paloaltonetworks.com/2016/11/unit42-tropic-trooper-targets-taiwanese-government-and-fossil-fuel-provider-with-poison-ivy/"},{"source_name":"TrendMicro Tropic Trooper May 2020","description":"Chen, J.. (2020, May 12). Tropic Trooper’s Back: USBferry Attack Targets Air gapped Environments. Retrieved May 20, 2020.","url":"https://documents.trendmicro.com/assets/Tech-Brief-Tropic-Trooper-s-Back-USBferry-Attack-Targets-Air-gapped-Environments.pdf"}]},{"id":"G0082","name":"APT38","url":"https://attack.mitre.org/groups/G0082","kind":"intrusion-set","description":"[APT38](https://attack.mitre.org/groups/G0082) leveraged Sysmon to understand the processes, services in the organization.(Citation: FireEye APT38 Oct 2018) [APT38](https://attack.mitre.org/groups/G0082) has used Python versions of its remote access tools on Linux targets.(Citation: Microsoft Axios Compromise APR 2026) [APT38](https://attack.mitre.org/groups/G0082) has also configured malicious payloads to gather running processes using `ps aux`.(Citation: Microsoft Sapphire Sleet APR 2026)(Citation: MIcrosoft Mastra npm Compromise JUN 2026) ","relationship_id":"relationship--f4d825cd-08d4-47ad-975c-37b886192e7c","references":[{"source_name":"FireEye APT38 Oct 2018","description":"FireEye. (2018, October 03). APT38: Un-usual Suspects. Retrieved November 17, 2024.","url":"https://services.google.com/fh/files/misc/apt38-un-usual-suspects.pdf"},{"source_name":"Microsoft Axios Compromise APR 2026","description":"Microsoft Threat Intelligence. (2026, April 1). Mitigating the Axios npm supply chain compromise. Retrieved September 30, 2026.","url":"https://www.microsoft.com/en-us/security/blog/2026/04/01/mitigating-the-axios-npm-supply-chain-compromise/"},{"source_name":"Microsoft Sapphire Sleet APR 2026","description":"Microsoft Threat Intelligence. (2026, April 16). Dissecting Sapphire Sleet’s macOS intrusion from lure to compromise. Retrieved September 30, 2026.","url":"https://www.microsoft.com/en-us/security/blog/2026/04/16/dissecting-sapphire-sleets-macos-intrusion-from-lure-to-compromise/"},{"source_name":"MIcrosoft Mastra npm Compromise JUN 2026","description":"Microsoft Threat Intelligence. (2026, June 17). From package to postinstall payload: Inside the Mastra npm supply chain compromise by Sapphire Sleet. Retrieved September 30, 2026.","url":"https://www.microsoft.com/en-us/security/blog/2026/06/17/postinstall-payload-inside-mastra-npm-supply-chain-compromise/"}]},{"id":"G0094","name":"Kimsuky","url":"https://attack.mitre.org/groups/G0094","kind":"intrusion-set","description":"[Kimsuky](https://attack.mitre.org/groups/G0094) can gather a list of all processes running on a victim's machine.(Citation: Talos Kimsuky Nov 2021) [Kimsuky](https://attack.mitre.org/groups/G0094) has also obtained running processes on the victim device utilizing PowerShell cmdlet `Get-Process`.(Citation: Securonix Kimsuky February 2025)","relationship_id":"relationship--ba7a0a7d-3a54-480f-86ce-f92d29dbabe1","references":[{"source_name":"Talos Kimsuky Nov 2021","description":"An, J and Malhotra, A. (2021, November 10). North Korean attackers use malicious blogs to deliver malware to high-profile South Korean targets. Retrieved December 29, 2021.","url":"https://blog.talosintelligence.com/2021/11/kimsuky-abuses-blogs-delivers-malware.html"},{"source_name":"Securonix Kimsuky February 2025","description":"Den Iuzvyk, Tim Peck. (2025, February 13). Analyzing DEEP#DRIVE: North Korean Threat Actors Observed Exploiting Trusted Platforms for Targeted Attacks. Retrieved August 19, 2025.","url":"https://www.securonix.com/blog/analyzing-deepdrive-north-korean-threat-actors-observed-exploiting-trusted-platforms-for-targeted-attacks/"}]},{"id":"G0100","name":"Inception","url":"https://attack.mitre.org/groups/G0100","kind":"intrusion-set","description":"[Inception](https://attack.mitre.org/groups/G0100) has used a reconnaissance module to identify active processes and other associated loaded modules.(Citation: Symantec Inception Framework March 2018)","relationship_id":"relationship--cece5cb5-3837-4551-be22-5c27b63eae63","references":[{"source_name":"Symantec Inception Framework March 2018","description":"Symantec. (2018, March 14). Inception Framework: Alive and Well, and Hiding Behind Proxies. Retrieved May 8, 2020.","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/inception-framework-hiding-behind-proxies"}]},{"id":"G0106","name":"Rocke","url":"https://attack.mitre.org/groups/G0106","kind":"intrusion-set","description":"[Rocke](https://attack.mitre.org/groups/G0106) can detect a running process's PID on the infected machine.(Citation: Anomali Rocke March 2019)\t","relationship_id":"relationship--a3d2ef4a-2bca-482d-897b-99da14b16b52","references":[{"source_name":"Anomali Rocke March 2019","description":"Anomali Labs. (2019, March 15). Rocke Evolves Its Arsenal With a New Malware Family Written in Golang. Retrieved April 24, 2019.","url":"https://www.anomali.com/blog/rocke-evolves-its-arsenal-with-a-new-malware-family-written-in-golang"}]},{"id":"G0112","name":"Windshift","url":"https://attack.mitre.org/groups/G0112","kind":"intrusion-set","description":"[Windshift](https://attack.mitre.org/groups/G0112) has used malware to enumerate active processes.(Citation: BlackBerry Bahamut)","relationship_id":"relationship--09237e32-a423-4ce3-bb15-4e47848ee7f7","references":[{"source_name":"BlackBerry Bahamut","description":"The BlackBerry Research & Intelligence Team. (2020, October). BAHAMUT: Hack-for-Hire Masters of Phishing, Fake News, and Fake Apps. Retrieved February 8, 2021.","url":"https://www.blackberry.com/us/en/pdfviewer?file=/content/dam/blackberry-com/asset/enterprise/pdf/direct/report-spark-bahamut.pdf"}]},{"id":"G0114","name":"Chimera","url":"https://attack.mitre.org/groups/G0114","kind":"intrusion-set","description":"[Chimera](https://attack.mitre.org/groups/G0114) has used <code>tasklist</code> to enumerate processes.(Citation: NCC Group Chimera January 2021)","relationship_id":"relationship--58207744-6e31-457e-b36e-b73d60bacd39","references":[{"source_name":"NCC Group Chimera January 2021","description":"Jansen, W . (2021, January 12). Abusing cloud services to fly under the radar. Retrieved September 12, 2024.","url":"https://web.archive.org/web/20230218064220/https://research.nccgroup.com/2021/01/12/abusing-cloud-services-to-fly-under-the-radar/"}]},{"id":"G0121","name":"Sidewinder","url":"https://attack.mitre.org/groups/G0121","kind":"intrusion-set","description":"[Sidewinder](https://attack.mitre.org/groups/G0121) has used tools to identify running processes on the victim's machine.(Citation: ATT Sidewinder January 2021)","relationship_id":"relationship--1e9f6719-24c5-4c8b-a832-506f46bbadb6","references":[{"source_name":"ATT Sidewinder January 2021","description":"Hegel, T. (2021, January 13). A Global Perspective of the SideWinder APT. Retrieved January 27, 2021.","url":"https://cdn-cybersecurity.att.com/docs/global-perspective-of-the-sidewinder-apt.pdf"}]},{"id":"G0125","name":"HAFNIUM","url":"https://attack.mitre.org/groups/G0125","kind":"intrusion-set","description":"[HAFNIUM](https://attack.mitre.org/groups/G0125) has used `tasklist` to enumerate processes.(Citation: Rapid7 HAFNIUM Mar 2021)","relationship_id":"relationship--465d0043-32d0-4ec9-84a6-c0f455f9a33b","references":[{"source_name":"Rapid7 HAFNIUM Mar 2021","description":"Eoin Miller. (2021, March 23). Defending Against the Zero Day: Analyzing Attacker Behavior Post-Exploitation of Microsoft Exchange. Retrieved October 27, 2022.","url":"https://www.rapid7.com/blog/post/2021/03/23/defending-against-the-zero-day-analyzing-attacker-behavior-post-exploitation-of-microsoft-exchange/"}]},{"id":"G0126","name":"Higaisa","url":"https://attack.mitre.org/groups/G0126","kind":"intrusion-set","description":"[Higaisa](https://attack.mitre.org/groups/G0126)’s shellcode attempted to find the process ID of the current process.(Citation: Zscaler Higaisa 2020)","relationship_id":"relationship--c6c5a455-14da-4d6f-8149-c0dc3bbd6f56","references":[{"source_name":"Zscaler Higaisa 2020","description":"Singh, S. Singh, A. (2020, June 11). The Return on the Higaisa APT. Retrieved March 2, 2021.","url":"https://www.zscaler.com/blogs/security-research/return-higaisa-apt"}]},{"id":"G0129","name":"Mustang Panda","url":"https://attack.mitre.org/groups/G0129","kind":"intrusion-set","description":"[Mustang Panda](https://attack.mitre.org/groups/G0129) has used <code>tasklist /v</code> to determine active process information.(Citation: Avira Mustang Panda January 2020) [Mustang Panda](https://attack.mitre.org/groups/G0129) has also used [TONESHELL](https://attack.mitre.org/software/S1239) malware to check the process name and process path to ensure it matches the expected one prior to triggering a custom exception handler.(Citation: 2022 November_TrendMicro_Earth Preta_Toneshell_Pubload)","relationship_id":"relationship--881641a8-77d9-4dce-9d4b-2388c9b11612","references":[{"source_name":"Avira Mustang Panda January 2020","description":"Hamzeloofard, S. (2020, January 31). New wave of PlugX targets Hong Kong | Avira Blog. Retrieved April 13, 2021.","url":"https://www.avira.com/en/blog/new-wave-of-plugx-targets-hong-kong"},{"source_name":"2022 November_TrendMicro_Earth Preta_Toneshell_Pubload","description":"Nick Dai, Vickie Su, Sunny Lu. (2022, November 18). Earth Preta Spear-Phishing Governments Worldwide. Retrieved August 4, 2025.","url":"https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html"}]},{"id":"G0138","name":"Andariel","url":"https://attack.mitre.org/groups/G0138","kind":"intrusion-set","description":"[Andariel](https://attack.mitre.org/groups/G0138) has used <code>tasklist</code> to enumerate processes and find a specific string.(Citation: Kaspersky Andariel Ransomware June 2021)","relationship_id":"relationship--63f08c72-9be6-45d5-9c60-2a4794795760","references":[{"source_name":"Kaspersky Andariel Ransomware June 2021","description":"Park, S. (2021, June 15). Andariel evolves to target South Korea with ransomware. Retrieved September 29, 2021.","url":"https://securelist.com/andariel-evolves-to-target-south-korea-with-ransomware/102811/"}]},{"id":"G0139","name":"TeamTNT","url":"https://attack.mitre.org/groups/G0139","kind":"intrusion-set","description":"[TeamTNT](https://attack.mitre.org/groups/G0139) has searched for rival malware and removes it if found.(Citation: Trend Micro TeamTNT) [TeamTNT](https://attack.mitre.org/groups/G0139) has also searched for running processes containing the strings aliyun or liyun to identify machines running Alibaba Cloud Security tools.(Citation: Cisco Talos Intelligence Group)","relationship_id":"relationship--4f85e333-375b-4a5b-8a15-a3bd061678a4","references":[{"source_name":"Cisco Talos Intelligence Group","description":"Darin Smith. (2022, April 21). TeamTNT targeting AWS, Alibaba. Retrieved August 4, 2022.","url":"https://blog.talosintelligence.com/teamtnt-targeting-aws-alibaba-2/"},{"source_name":"Trend Micro TeamTNT","description":"Fiser, D. Oliveira, A. (n.d.). Tracking the Activities of TeamTNT A Closer Look at a Cloud-Focused Malicious Actor Group. Retrieved September 22, 2021.","url":"https://documents.trendmicro.com/assets/white_papers/wp-tracking-the-activities-of-teamTNT.pdf"}]},{"id":"G1001","name":"HEXANE","url":"https://attack.mitre.org/groups/G1001","kind":"intrusion-set","description":"[HEXANE](https://attack.mitre.org/groups/G1001) has enumerated processes on targeted systems.(Citation: Kaspersky Lyceum October 2021)","relationship_id":"relationship--cca0aac6-bdc2-48da-9b95-c24e41f5a116","references":[{"source_name":"Kaspersky Lyceum October 2021","description":"Kayal, A. et al. (2021, October). LYCEUM REBORN: COUNTERINTELLIGENCE IN THE MIDDLE EAST. Retrieved June 14, 2022.","url":"https://vblocalhost.com/uploads/VB2021-Kayal-etal.pdf"}]},{"id":"G1006","name":"Earth Lusca","url":"https://attack.mitre.org/groups/G1006","kind":"intrusion-set","description":"[Earth Lusca](https://attack.mitre.org/groups/G1006) has used [Tasklist](https://attack.mitre.org/software/S0057) to obtain information from a compromised host.(Citation: TrendMicro EarthLusca 2022)","relationship_id":"relationship--6ef89fa5-cd74-499b-bbc0-3b0d83baeba1","references":[{"source_name":"TrendMicro EarthLusca 2022","description":"Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022.","url":"https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/a/earth-lusca-employs-sophisticated-infrastructure-varied-tools-and-techniques/technical-brief-delving-deep-an-analysis-of-earth-lusca-operations.pdf"}]},{"id":"G1017","name":"Volt Typhoon","url":"https://attack.mitre.org/groups/G1017","kind":"intrusion-set","description":"[Volt Typhoon](https://attack.mitre.org/groups/G1017) has enumerated running processes on targeted systems including through the use of [Tasklist](https://attack.mitre.org/software/S0057).(Citation: Microsoft Volt Typhoon May 2023)(Citation: Secureworks BRONZE SILHOUETTE May 2023)(Citation: CISA AA24-038A PRC Critical Infrastructure February 2024)","relationship_id":"relationship--0ffa13fd-ca80-4541-a166-9c297145180d","references":[{"source_name":"CISA AA24-038A PRC Critical Infrastructure February 2024","description":"CISA et al.. (2024, February 7). PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure. Retrieved May 15, 2024.","url":"https://www.cisa.gov/sites/default/files/2024-03/aa24-038a_csa_prc_state_sponsored_actors_compromise_us_critical_infrastructure_3.pdf"},{"source_name":"Secureworks BRONZE SILHOUETTE May 2023","description":"Counter Threat Unit Research Team. (2023, May 24). Chinese Cyberespionage Group BRONZE SILHOUETTE Targets U.S. Government and Defense Organizations. Retrieved July 27, 2023.","url":"https://web.archive.org/web/20230601025540/https://www.secureworks.com/blog/chinese-cyberespionage-group-bronze-silhouette-targets-us-government-and-defense-organizations"},{"source_name":"Microsoft Volt Typhoon May 2023","description":"Microsoft Threat Intelligence. (2023, May 24). Volt Typhoon targets US critical infrastructure with living-off-the-land techniques. Retrieved July 27, 2023.","url":"https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/"}]},{"id":"G1022","name":"ToddyCat","url":"https://attack.mitre.org/groups/G1022","kind":"intrusion-set","description":"[ToddyCat](https://attack.mitre.org/groups/G1022) has run `cmd /c start /b tasklist` to enumerate processes.(Citation: Kaspersky ToddyCat Check Logs October 2023)","relationship_id":"relationship--8d5b3c01-b260-4212-a4f0-f061c3c701cf","references":[{"source_name":"Kaspersky ToddyCat Check Logs October 2023","description":"Dedola, G. et al. (2023, October 12). ToddyCat: Keep calm and check logs. Retrieved January 3, 2024.","url":"https://securelist.com/toddycat-keep-calm-and-check-logs/110696/"}]},{"id":"G1023","name":"APT5","url":"https://attack.mitre.org/groups/G1023","kind":"intrusion-set","description":"[APT5](https://attack.mitre.org/groups/G1023) has used Windows-based utilities to carry out tasks including tasklist.exe. (Citation: Mandiant Pulse Secure Update May 2021)","relationship_id":"relationship--9b5abfd2-7c22-48df-bda3-62648c6cac8c","references":[{"source_name":"Mandiant Pulse Secure Update May 2021","description":"Perez, D. et al. (2021, May 27). Re-Checking Your Pulse: Updates on Chinese APT Actors Compromising Pulse Secure VPN Devices. Retrieved February 5, 2024.","url":"https://www.mandiant.com/resources/blog/updates-on-chinese-apt-compromising-pulse-secure-vpn-devices"}]},{"id":"G1040","name":"Play","url":"https://attack.mitre.org/groups/G1040","kind":"intrusion-set","description":"\n[Play](https://attack.mitre.org/groups/G1040) has used the information stealer Grixba to check for a list of security processes.(Citation: Trend Micro Ransomware Spotlight Play July 2023)","relationship_id":"relationship--4b7e9da5-e087-4a1d-8df0-82910bd3b1c3","references":[{"source_name":"Trend Micro Ransomware Spotlight Play July 2023","description":"Trend Micro Research. (2023, July 21). Ransomware Spotlight: Play. Retrieved September 24, 2024.","url":"https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-play"}]},{"id":"G1048","name":"UNC3886","url":"https://attack.mitre.org/groups/G1048","kind":"intrusion-set","description":"[UNC3886](https://attack.mitre.org/groups/G1048) has run scripts to list all running processes on a guest VM from an ESXi host.(Citation: Google Cloud Threat Intelligence VMWare ESXi Zero-Day 2023)","relationship_id":"relationship--a0595621-4352-48e6-8ac2-6a7b87b254ac","references":[{"source_name":"Google Cloud Threat Intelligence VMWare ESXi Zero-Day 2023","description":"Alexander Marvi, Brad Slaybaugh, Ron Craft, and Rufus Brown. (2023, June 13). VMware ESXi Zero-Day Used by Chinese Espionage Actor to Perform Privileged Guest Operations on Compromised Hypervisors. Retrieved March 26, 2025.","url":"https://cloud.google.com/blog/topics/threat-intelligence/vmware-esxi-zero-day-bypass/"}]},{"id":"G1051","name":"Medusa Group","url":"https://attack.mitre.org/groups/G1051","kind":"intrusion-set","description":"[Medusa Group](https://attack.mitre.org/groups/G1051) has utilized a hard-coded security tool process list that identifies and terminates using an undocumented IOCTL code 0x222094.(Citation: Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024)","relationship_id":"relationship--80f8b06e-a4a5-41d0-8828-1c77f796a39a","references":[{"source_name":"Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024","description":"Anthony Galiette, Doel Santos. (2024, January 11). Medusa Ransomware Turning Your Files into Stone. Retrieved October 15, 2025.","url":"https://unit42.paloaltonetworks.com/medusa-ransomware-escalation-new-leak-site/"}]},{"id":"G1053","name":"Storm-0501","url":"https://attack.mitre.org/groups/G1053","kind":"intrusion-set","description":"[Storm-0501](https://attack.mitre.org/groups/G1053) has discovered running processes through `tasklist.exe`.(Citation: Microsoft Storm-501 Sabbath Ransomware Embargo September 2024)","relationship_id":"relationship--6b2d240a-66f6-484c-a6f6-04661860ae0e","references":[{"source_name":"Microsoft Storm-501 Sabbath Ransomware Embargo September 2024","description":"Microsoft Threat Intelligence. (2024, September 26). Storm-0501: Ransomware attacks expanding to hybrid cloud environments. Retrieved October 19, 2025.","url":"https://www.microsoft.com/en-us/security/blog/2024/09/26/storm-0501-ransomware-attacks-expanding-to-hybrid-cloud-environments/"}]},{"id":"G1054","name":"MirrorFace","url":"https://attack.mitre.org/groups/G1054","kind":"intrusion-set","description":"[MirrorFace](https://attack.mitre.org/groups/G1054) has used [Tasklist](https://attack.mitre.org/software/S0057) on compromised hosts for discovery.(Citation: JPCERT MirrorFace JUL 2024)","relationship_id":"relationship--08cdfbc3-eefb-44a2-9ec1-59b2dbc76392","references":[{"source_name":"JPCERT MirrorFace JUL 2024","description":"Tomonaga, S. (2024, July 16). MirrorFace Attack against Japanese Organisations. Retrieved April 17, 2026.","url":"https://blogs.jpcert.or.jp/en/2024/07/mirrorface-attack-against-japanese-organisations.html"}]},{"id":"G1059","name":"NIMBUS MANTICORE","url":"https://attack.mitre.org/groups/G1059","kind":"intrusion-set","description":"[NIMBUS MANTICORE](https://attack.mitre.org/groups/G1059) has enumerated active processes using remote management services to include Atelier Web Remote Commander (AWRC).(Citation: Mandiant_UNC1549TTPsTools_Nov2025)    ","relationship_id":"relationship--34c63b13-dfd5-4b44-9c74-37068cbe46da","references":[{"source_name":"Mandiant_UNC1549TTPsTools_Nov2025","description":"El-Banna, M., et al. (2025, November 17). Frontline Intelligence: Analysis of UNC1549 TTPs, Custom Tools, and Malware Targeting the Aerospace and Defense Ecosystem. Retrieved September 28, 2026.","url":"https://cloud.google.com/blog/topics/threat-intelligence/analysis-of-unc1549-ttps-targeting-aerospace-defense"}]}],"mitigations":[],"candidates":[{"id":"11ba69ee-902e-4a0f-b3b6-418aed7d7ddb","name":"Discover Specific Process - tasklist","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1057/T1057.yaml","description":"Adversaries may use command line tools to discover specific processes in preparation of further attacks. \nExamples of this could be discovering the PID of lsass.exe to dump its memory or discovering whether specific security processes (e.g. AV or EDR) are running.\n","inputs":{"process_to_enumerate":{"description":"Process name string to search for.","type":"string","default":"lsass"}},"dependencies":[],"source_definition_sha256":"68db9c6e671ae7691e8bb5570bee3300c2aa03cd84222df558970f3b68108faf"},{"id":"3b3809b6-a54b-4f5b-8aff-cb51f2e97b34","name":"Process Discovery - Get-Process","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1057/T1057.yaml","description":"Utilize Get-Process PowerShell cmdlet to identify processes.\n\nUpon successful execution, powershell.exe will execute Get-Process to list processes. Output will be via stdout. \n","inputs":{},"dependencies":[],"source_definition_sha256":"c255a6392d34b9efcacc9ca370b9f18f5c5c3e8af22f7aa884c7ad0288ba0f1c"},{"id":"4fd35378-39aa-481e-b7c4-e3bf49375c67","name":"Launch Taskmgr from cmd to View running processes","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1057/T1057.yaml","description":"An adverary may launch taskmgr.exe with the /7 switch via command prompt to view processes running on the system.\n[Reference](https://github.com/trellix-enterprise/ac3-threat-sightings/blob/main/sightings/Sightings_Conti_Ransomware.yml)\n","inputs":{},"dependencies":[],"source_definition_sha256":"86adcea25d9faf8590d7c83edaed00512fad68f21e563925017310435df6e18c"},{"id":"4ff64f0b-aaf2-4866-b39d-38d9791407cc","name":"Process Discovery - ps","platforms":["linux","macos"],"method":"automated","executor":"sh","elevation_required":false,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1057/T1057.yaml","description":"Utilize ps to identify processes.\n\nUpon successful execution, sh will execute ps and output to /tmp/loot.txt.\n","inputs":{"output_file":{"description":"path of output file","type":"path","default":"/tmp/loot.txt"}},"dependencies":[],"source_definition_sha256":"42b2485a0d66c52fb535e49db1cbdaaa07369763a8150b6a94d108a6e4697533"},{"id":"640cbf6d-659b-498b-ba53-f6dd1a1cc02c","name":"Process Discovery - wmic process","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1057/T1057.yaml","description":"Utilize windows management instrumentation to identify processes.\n\nUpon successful execution, WMIC will execute process to list processes. Output will be via stdout. \n","inputs":{},"dependencies":[],"source_definition_sha256":"71c3abe897ddd2a7d1042ce5a43e6de2983227e92f4893cdd350a3be8b477816"},{"id":"668f1d74-4bdb-4209-91e3-b31df0e4fbb7","name":"Check Process Token Elevation via GetTokenInformation","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1057/T1057.yaml","description":"Uses C# P/Invoke to call OpenProcessToken and GetTokenInformation with TokenElevation\nto discover whether the current process is running with elevated privileges. Adversaries\nuse this API-level check to determine their privilege context before deciding whether\nto attempt privilege escalation. Turla's ApolloShadow does this to determine its path of execution.\n\nReference: https://www.microsoft.com/en-us/security/blog/2025/07/31/frozen-in-transit-secret-blizzards-aitm-campaign-against-diplomats/\n","inputs":{},"dependencies":[],"source_definition_sha256":"f3bc7138d9215eec808d2fbef33e4e92c3c990ae2f7463bc70fd6227c50a4553"},{"id":"966f4c16-1925-4d9b-8ce0-01334ee0867d","name":"Process Discovery - Process Hacker","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":true,"dependency_count":1,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1057/T1057.yaml","description":"Process Hacker can be exploited to infiltrate system processes, identify weak points, or achieve unauthorized control over systems. However, its malicious use can often be flagged by security defenses, rendering it a perilous tool for illegitimate purposes.","inputs":{"processhacker_exe":{"description":"Process hacker installation executables.","type":"string","default":"ProcessHacker.exe"}},"dependencies":[{"description":"Process Hacker must be installed in the location"}],"source_definition_sha256":"0694d3b24d621919713f6d18c012c3a1c6618c998e6867724bd95aa1e371d2a7"},{"id":"b4ca838d-d013-4461-bf2c-f7132617b409","name":"Process Discovery - PC Hunter","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":true,"dependency_count":1,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1057/T1057.yaml","description":"PC Hunter is a toolkit with access to hundreds of settings including kernels, kernel modules, processes, network, startup, and more. When abused, this tool can allow threat actors to effectively access sensitive processes, collect system information, and terminate security software.","inputs":{"pchunter64_exe":{"description":"Process hacker installation executables.","type":"string","default":"PChunter64.exe"}},"dependencies":[{"description":"PCHunter must be present in device"}],"source_definition_sha256":"7b270bb8dac3232f8fa69a99b215d6d4e8fbbb528ab6473babab57b675851eda"},{"id":"b51239b4-0129-474f-a2b4-70f855b9f2c2","name":"Process Discovery - get-wmiObject","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1057/T1057.yaml","description":"Utilize get-wmiObject PowerShell cmdlet to identify processes.\n\nUpon successful execution, powershell.exe will execute get-wmiObject to list processes. Output will be via stdout. \n","inputs":{},"dependencies":[],"source_definition_sha256":"c1ce438c27576443bae6ada587b96c48ad9e339f79447223eb49fe48f6dc3c82"},{"id":"c5806a4f-62b8-4900-980b-c7ec004e9908","name":"Process Discovery - tasklist","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1057/T1057.yaml","description":"Utilize tasklist to identify processes.\n\nUpon successful execution, cmd.exe will execute tasklist.exe to list processes. Output will be via stdout. \n","inputs":{},"dependencies":[],"source_definition_sha256":"77a0e2b5c4a026efa15bb2e30208a254cd3e50ea462bf75b663ccc2d9f1c5fdf"}],"simulation":{"atomic_status":"documented_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1057":"/ttp-simulation/techniques/enterprise/T1057/","T1059.001":"/ttp-simulation/techniques/enterprise/T1059.001/","T1106":"/ttp-simulation/techniques/enterprise/T1106/","T1059.008":"/ttp-simulation/techniques/enterprise/T1059.008/","T1055":"/ttp-simulation/techniques/enterprise/T1055/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"enterprise/T1057","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0064","collector":"illustrative-lab-collector","observation":{"interpreter":"/bin/sh","command_line":"printf LAB_TELEMETRY_CHECK","actor_uid":1000,"session_id":"lab-session-1"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0055","collector":"illustrative-lab-collector","observation":{"path":"C:\\Lab\\demo.txt","access":"read","actor":"LAB\\analyst","result":"success"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0035","collector":"illustrative-lab-collector","observation":{"source_process_id":4200,"target_process_id":4300,"granted_access":"0x1000","action":"open_process"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0034","collector":"illustrative-lab-collector","observation":{"process_id":4200,"image":"/usr/bin/sleep","owner_uid":1000,"started_at":"2026-09-27T11:59:00Z"}}]}}