T1057: Process Discovery

Discovery Intelligence Profile

AI Answer

Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Administrator or otherwise elevated access may provide better process details. Adversaries may use the information from [Process Discovery](https://attack.mitre.org/techniques/T1057) during automated discovery to shape follow-on behaviors, (Source: MITRE ATT&CK T1057)

Confidence: 0.9 · Source: MITRE ATT&CK · Requires review: yes · Freshness: 2026-09-07

ATT&CK Mapping

Field	Value
Technique ID	T1057
Name	Process Discovery
Tactic	Discovery (discovery)
Platforms	ESXi, Linux, macOS, Network Devices, Windows
Sub-technique	No

Why it matters

In the OpenTrojan knowledge graph, Process Discovery (T1057) is one of the highest-connectivity ATT&CK techniques: 319 MITRE STIX relationships reference this technique; 41 threat groups observed using it; 268 software families associated; 10 campaigns associated. These counts are derived from MITRE ATT&CK STIX relationships and are not an estimate of exploitation volume.

How attackers use it

Behavior described below is from the MITRE ATT&CK canonical definition (source: https://attack.mitre.org/techniques/T1057). Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Administrator or otherwise elevated access may provide better process details. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. In Windows environments, adversaries could obtain details on running processes using the Tasklist utility via cmd or Get-Process via PowerShell. Information about processes can also be extracted from the output of Native API calls such as CreateToolhelp32Snapshot. In Mac and Linux, this is accomplished with the ps command. Adversaries may also opt to enumerate processes via /proc. ESXi also supports use of the ps command, as well as esxcli system process list. On network devices, Network Device CLI commands such as show processes can be used to display current running processes.

Detection

DET0034 Detection of Adversarial Process Discovery Behavior AN0095 Identifies adversary behavior that launches commands or invokes APIs to enumerate active processes (e.g., tasklist.exe, Get-Process, or CreateToolhelp32Snapshot). Detects execution combined with parent process lineage, network session context, or remote origin. AN0096 Detects execution of common process enumeration utilities (e.g., ps, top, htop) or access to /proc with suspicious ancestry. Correlates command usage with interactive shell context and user role. AN0097 Monitors execution of ps, top, or launchctl with unusual parent processes or from terminal scripts. Also detects AppleScript-based process listing or system_profiler SPApplicationsDataType misuse. AN0098 Detects process enumeration using esxcli system process list or ps on ESXi shell or via unauthorized SSH sessions. Correlates with interactive sessions and abnormal user roles. AN0099 Monitors CLI-based execution of show process or equivalent on routers/switches. Correlates unusual device access, unauthorized roles, or config mode changes.

Detection strategy text is from the MITRE ATT&CK official technique page (https://attack.mitre.org/techniques/T1057).

Mitigation

Not available — no MITRE course-of-action was found for this technique in the ingested dataset.

TrickBot
PowerDuke
EKANS
Ninja
RCSession
SynAck
Bumblebee
BRICKSTORM
Proxysvc
Orz
yty
Backdoor.Oldrea

Software associations are from MITRE ATT&CK STIX relationships (observed usage, not attribution).

APT38
APT3
Kimsuky
Volt Typhoon
HAFNIUM
MuddyWater
Gamaredon Group
TeamTNT
FIN7
Andariel
Sidewinder
Mustang Panda

Group associations are from MITRE ATT&CK STIX relationships.

KV Botnet Activity
Frankenstein
RedPenguin
Operation Honeybee
C0015
SolarWinds Compromise
FunnyDream
Operation CuckooBees
2025 Poland Wiper Attacks
Operation Wocao

Campaign associations are from MITRE ATT&CK STIX relationships.

References

Source Attribution

Source: MITRE ATT&CK (MITRE ATT&CK) · Confidence: 0.9 · Reviewed: OpenTrojan - Human Review

Start Investigation

Move from reading to investigating T1057 Process Discovery. The workspace is a structured analysis surface — not a chat — organised as:

Question — what do you need to know about T1057 Process Discovery?
Evidence — assertions mapped to verifiable references.
Timeline — events in chronological order.
Related Entities — CVE, threat actor, campaign, malware links.
Sources — NVD, CISA KEV, MITRE ATT&CK, vendor advisories.
Notes — your own observations and working hypotheses.

AI assistance is limited to summarising, explaining, and suggesting related evidence. AI never completes your investigation, modifies entity relationships, or generates facts — all published analysis stays human-reviewed.

Start Investigation Open Workspace