T1057 Process Discovery

Adversaries may attempt to get information about running processes on a system. MITRE ATT&CK

1 program on CmdID 5 Sigma rules T1057 on attack.mitre.org

Programs for it

documented by LOLBAS and GTFOBins, or named by its rules

process creation, the highest levels first

highHackTool - PCHunter ExecutionFlorian Roth (Nextron Systems), Nasreddine Bencherchali · Windows

mediumRecon Command Output Piped To Findstr.EXENasreddine Bencherchali (Nextron Systems), frack113 · Windows

lowProcess DiscoveryÖmer Günal, oscd.community, CheraaghiMilad · Linux

everyday examples from tldr-pages, CC BY 4.0

Start fzf for running processes on the page for fzf

ps aux | fzfIdentify

Start top on the page for top

Do not show any idle or zombie processes on the page for top

top --idle-toggleIdentify

Show only processes owned by given user on the page for top

top --filter-only-euser usernameIdentify

Show brief details about the currently running processes on the page for wmic.exe

wmic process list briefIdentify

Show full details about the currently running processes on the page for wmic.exe

wmic process list fullIdentify

Start on the page for atop

Start and display memory consumption for each process on the page for atop

atop -mIdentify

Start and display disk information on the page for atop

atop -dIdentify

Start and display background process information on the page for atop

atop -cIdentify

Start and display thread-specific resource utilization information on the page for atop

atop -yIdentify

Start and display the number of processes for each user on the page for atop

atop -auIdentify

And 46 more examples on CmdID’s program pages.

An example is here when CmdID’s reading of it names T1057: a Sigma rule it trips is tagged with it, or its abuse is documented as it.