CmdID

CmdID / Commands

tasklist

Displays a list of currently running processes on the local computer or on a remote computer. Windows commands reference

On Windows 5 Sigma rules name it File tasklist.exe

Opens CmdID with your command. It is read in your browser and sent nowhere.

Windows

from the Windows commands reference, CC BY 4.0

Displays a list of currently running processes on the local computer or on a remote computer. Tasklist replaces the tlist tool. NOTE: This command replaces the tlist tool.

tasklist [/s <computer> [/u [<domain>\]<username> [/p <password>]]] [{/m <module> | /svc | /v}] [/fo {table | list | csv}] [/nh] [/fi <filter> [/fi <filter> [ ... ]]]

To list all tasks with a process ID greater than 1000, and display them in csv format, type

tasklist /v /fi "PID gt 1000" /fo csvIdentify
/vDisplays verbose task information in the output. Windows commands reference
/fiSpecifies the types of processes to include in or exclude from the query. Windows commands reference
/foSpecifies the format to use for the output. Windows commands reference

Trips 1 Sigma rule: informationalSuspicious Tasklist Discovery Command by frack113

To list the system processes that are currently running, type

tasklist /fi "USERNAME ne NT AUTHORITY\SYSTEM" /fi "STATUS eq running"Identify
/fiSpecifies the types of processes to include in or exclude from the query. Windows commands reference

Trips 1 Sigma rule: informationalSuspicious Tasklist Discovery Command by frack113

To list detailed information for all processes that are currently running, type

tasklist /v /fi "STATUS eq running"Identify
/vDisplays verbose task information in the output. Windows commands reference
/fiSpecifies the types of processes to include in or exclude from the query. Windows commands reference

Trips 1 Sigma rule: informationalSuspicious Tasklist Discovery Command by frack113

To list all the service information for processes on the remote computer srvmain, which has a DLL name beginning with ntdll, type

tasklist /s srvmain /svc /fi "MODULES eq ntdll*"Identify
/sSpecifies the name or IP address of a remote computer (do not use backslashes). Windows commands reference
/fiSpecifies the types of processes to include in or exclude from the query. Windows commands reference

Trips 2 Sigma rules: highPotential WinAPI Calls Via CommandLine by Nasreddine Bencherchali (Nextron Systems); informationalSuspicious Tasklist Discovery Command by frack113

To list the processes on the remote computer srvmain, using the credentials of your currently logged-on user account, type

tasklist /s srvmainIdentify
/sSpecifies the name or IP address of a remote computer (do not use backslashes). Windows commands reference

Trips 1 Sigma rule: informationalSuspicious Tasklist Discovery Command by frack113

To list the processes on the remote computer srvmain, using the credentials of the user account Hiropln, type

tasklist /s srvmain /u maindom\hiropln /p p@ssW23Identify
/sSpecifies the name or IP address of a remote computer (do not use backslashes). Windows commands reference
/uRuns the command with the account permissions of the user who is specified by or by \. Windows commands reference
/pSpecifies the password of the user account that is specified in the /u parameter. Windows commands reference

Trips 1 Sigma rule: informationalSuspicious Tasklist Discovery Command by frack113

Show 21 options
/s <computer>Specifies the name or IP address of a remote computer (do not use backslashes). The default is the local computer.
/u <domain>\<username>Runs the command with the account permissions of the user who is specified by <username> or by <domain>\<username>. The /u parameter can be specified only if /s is also specified. The default is the permissions of the user who is currently logged on to the computer that is issuing the command.
/p <password>Specifies the password of the user account that is specified in the /u parameter.
/m <module>Lists all tasks with DLL modules loaded that match the given pattern name. If the module name is not specified, this option displays all modules loaded by each task.
svcLists all the service information for each process without truncation. Valid when the /fo parameter is set to table.
/vDisplays verbose task information in the output. For complete verbose output without truncation, use /v and /svc together.
/fo {table | list | csv}Specifies the format to use for the output. Valid values are table, list, and csv. The default format for output is table.
/nhSuppresses column headers in the output. Valid when the /fo parameter is set to table or csv.
/fi <filter>Specifies the types of processes to include in or exclude from the query. You can use more than one filter or use the wildcard character (\) to specify all tasks or image names. The valid filters are listed in the Filter names, operators, and values section of this article.
/?Displays help at the command prompt.
STATUSeq, ne RUNNING NOT RESPONDING UNKNOWN. This filter isn't supported if you specify a remote system.
IMAGENAMEeq, ne Image name
PIDeq, ne, gt, lt, ge, le PID value
SESSIONeq, ne, gt, lt, ge, le Session number
SESSIONNAMEeq, ne Session name
CPUtimeeq, ne, gt, lt, ge, le CPU time in the format HH:MM:SS, where MM and SS are between 0 and 59 and HH is any unsigned number
MEMUSAGEeq, ne, gt, lt, ge, le Memory usage in KB
USERNAMEeq, ne Any valid user name (<user> or <domain\user>)
SERVICESeq, ne Service name
WINDOWTITLEeq, ne Window title. This filter isn't supported if you specify a remote system.
MODULESeq, ne DLL name

Windows

from tldr-pages, CC BY 4.0

Display a list of currently running processes on a local or remote machine.

Display currently running processes

tasklistIdentify

Trips 1 Sigma rule: informationalSuspicious Tasklist Discovery Command by frack113

Display running processes in a specified output format

tasklist /fo tableIdentify
/foSpecifies the format to use for the output. Windows commands reference

Trips 1 Sigma rule: informationalSuspicious Tasklist Discovery Command by frack113

Display running processes using the specified .exe or .dll file name

tasklist /m module_patternIdentify
/mLists all tasks with DLL modules loaded that match the given pattern name. Windows commands reference

Trips 1 Sigma rule: informationalSuspicious Tasklist Discovery Command by frack113

Display processes running on a remote machine

tasklist /s remote_name /u username /p passwordIdentify
/sSpecifies the name or IP address of a remote computer (do not use backslashes). Windows commands reference
/uRuns the command with the account permissions of the user who is specified by or by \. Windows commands reference
/pSpecifies the password of the user account that is specified in the /u parameter. Windows commands reference

Trips 1 Sigma rule: informationalSuspicious Tasklist Discovery Command by frack113

Display services using each process

tasklist /svcIdentify

Trips 1 Sigma rule: informationalSuspicious Tasklist Discovery Command by frack113

What detects it

Sigma process creation rules that name tasklist
criticalSuspicious Child Process Of Veeam DabataseNasreddine Bencherchali (Nextron Systems)
highSuspicious Child Process Of SQL ServerFPT.EagleEye Team, wagga
highWebshell Detection With Command Line KeywordsFlorian Roth (Nextron Systems), Jonhnathan Ribeiro, Anton Kutepov, oscd.community, Chad Hudson, Matt Anderson
mediumLoaded Module Enumeration Via Tasklist.EXESwachchhanda Shrawan Poudel
informationalSuspicious Tasklist Discovery Commandfrack113