T1057 Process Discovery — Attack Simulation

Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Administrator or otherwise elevated access may provide better process details. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary…

Technique description

At least one platform-compatible Atomic procedure is documented. Individual review, lab prerequisites, and validation remain required.

Official ATT&CK definition · Detection rules and anomaly models

Documented simulation candidates

Discover Specific Process - tasklist
windows automated command_prompt
Procedure 11ba69ee-902e-4a0f-b3b6-418aed7d7ddb; elevation not declared required; cleanup not declared. Not executed or individually validated.
Process Discovery - Get-Process
windows automated powershell
Procedure 3b3809b6-a54b-4f5b-8aff-cb51f2e97b34; elevation not declared required; cleanup not declared. Not executed or individually validated.
Launch Taskmgr from cmd to View running processes
windows automated command_prompt
Procedure 4fd35378-39aa-481e-b7c4-e3bf49375c67; elevation not declared required; cleanup not declared. Not executed or individually validated.
Process Discovery - ps
linux macos automated sh
Procedure 4ff64f0b-aaf2-4866-b39d-38d9791407cc; elevation not declared required; cleanup present, not reviewed. Not executed or individually validated.
Process Discovery - wmic process
windows automated command_prompt
Procedure 640cbf6d-659b-498b-ba53-f6dd1a1cc02c; elevation not declared required; cleanup not declared. Not executed or individually validated.
Check Process Token Elevation via GetTokenInformation
windows automated powershell
Procedure 668f1d74-4bdb-4209-91e3-b31df0e4fbb7; elevation not declared required; cleanup not declared. Not executed or individually validated.
Process Discovery - Process Hacker
windows automated powershell
Procedure 966f4c16-1925-4d9b-8ce0-01334ee0867d; elevation required; cleanup not declared. Not executed or individually validated.
Process Discovery - PC Hunter
windows automated powershell
Procedure b4ca838d-d013-4461-bf2c-f7132617b409; elevation required; cleanup not declared. Not executed or individually validated.
Process Discovery - get-wmiObject
windows automated powershell
Procedure b51239b4-0129-474f-a2b4-70f855b9f2c2; elevation not declared required; cleanup not declared. Not executed or individually validated.
Process Discovery - tasklist
windows automated command_prompt
Procedure c5806a4f-62b8-4900-980b-c7ec004e9908; elevation not declared required; cleanup not declared. Not executed or individually validated.

Connected ecosystem references

Linked tags

enterprise cloud-hosted-endpoint network-infrastructure onprem virtualization ESXi Linux macOS Network Devices Windows discovery isolated_authorized_lab procedure_review_required telemetry_configuration_required some_candidates_require_elevation

can_simulate technique source_mapped

Detection and collection

T1057 detection workspace

Attack tools

Threat actor context

These are explicit actor-to-technique associations in the existing Threat Matrix snapshot, not attribution of an event or proof that a detector identifies the actor. No tool-to-actor relationship is inferred.

Existing research

Threat Matrix: knowledge routes, evidence and actor context

Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.