T1057 Process Discovery — Detection Rules

Source-backed rule directory

• System Info Discovery via Sysinfo Syscall · experimental · low · {"product":"linux","service":"auditd","definition":"Required auditd configuration:\n-a always,exit -F arch=b64 -S sysinfo -k discovery_sysinfo_syscall\n-a always,exit -F arch=b32 -S sysinfo -k discovery_sysinfo_syscall\n"}
• Cisco Discovery · test · low · {"product":"cisco","service":"aaa"}
• Suspicious Process Discovery With Get-Process · test · low · {"product":"windows","category":"ps_script","definition":"Requirements: Script Block Logging must be enabled"}
• Recon Command Output Piped To Findstr.EXE · test · medium · {"category":"process_creation","product":"windows"}
• HackTool - PCHunter Execution · test · high · {"category":"process_creation","product":"windows"}
• Potential Process Reconnaissance via Wmic.EXE · test · medium · {"category":"process_creation","product":"windows"}

Atlas deterministic concepts

T1057 Process Discovery

MATCH(command_or_api IN process_enumeration_operations) AND caller NOT_IN approved_tools -> ALERT

• Process Execution Logs
• Endpoint Detection and Response Telemetry
• Atlas source section

Anomaly models

No exact Atlas model in this snapshot.

ATT&CK analytic guidance

DET0034 Detection of Adversarial Process Discovery Behavior

AN0095 Analytic 0095

Identifies adversary behavior that launches commands or invokes APIs to enumerate active processes (e.g., tasklist.exe, Get-Process, or CreateToolhelp32Snapshot). Detects execution combined with parent process lineage, network session context, or remote origin.

AN0096 Analytic 0096

Detects execution of common process enumeration utilities (e.g., ps, top, htop) or access to /proc with suspicious ancestry. Correlates command usage with interactive shell context and user role.

AN0097 Analytic 0097

Monitors execution of ps, top, or launchctl with unusual parent processes or from terminal scripts. Also detects AppleScript-based process listing or `system_profiler SPApplicationsDataType` misuse.

AN0098 Analytic 0098

Detects process enumeration using `esxcli system process list` or `ps` on ESXi shell or via unauthorized SSH sessions. Correlates with interactive sessions and abnormal user roles.

AN0099 Analytic 0099

Monitors CLI-based execution of `show process` or equivalent on routers/switches. Correlates unusual device access, unauthorized roles, or config mode changes.