Log in Request a demo

Attack technique

Process Discovery

Process Discovery is a technique where attackers list the programs running on a system.

In short

Process Discovery is a technique where attackers list the programs running on a system. The result tells them what software is present and helps them decide what to do next, for example whether to fully infect the target. MITRE tracks it as T1057 under the Discovery tactic.

Last updated 8 October 2026

Profile MapTechnique
  1. Reconnaissance
  2. Resource Development
  3. Initial Access
  4. Execution
  5. Persistence
  6. Privilege Escalation
  7. Stealth
  8. Defense Impairment
  9. Credential Access
  10. Discovery
  11. Lateral Movement
  12. Collection
  13. Command and Control
  14. Exfiltration
  15. Impact

Discovery · Step 10 Of 15 In The Attack Chain

  1. MITRE IDT1057ATT&CK technique
  2. Detection4ways to spot itDetection strategy MITRE lists
  3. Defences2ways to stop itAccept limited prevention · Monitor and correlate

How it works

After gaining a foothold, attackers want to understand the system. A list of running processes shows which applications and tools are active.

They can use this information during automated discovery to shape what they do next, for example whether to fully infect the target or to try specific actions. Administrator or other elevated access may give better process details.

MITRE notes that built-in commands, scripting tools and system programming interfaces can all return this information on Windows, Mac, Linux, ESXi and network devices.

A real example

Procedure examples listed by MITRE ATT&CK:

  • Azorult can collect a list of running processes by calling CreateToolhelp32Snapshot.
  • ZxShell has a command, ps, that lists the processes on the system.
  • Avaddon has collected information about running processes.
  • AsyncRAT can examine running processes to find out whether a debugger is present.
  • Akira checks for the process ID of the process that deletes volume shadow copies, to verify the deletion worked.

How to detect

  1. Process listing with odd context

    Watch for commands or system calls that list active processes when they come from an unusual parent process, a remote session or a script.

  2. Interactive use by unexpected roles

    Correlate process listing with interactive shells and user roles, so that use by an account that would not normally do it stands out.

  3. Network device and ESXi activity

    Monitor process listing on ESXi hosts and network devices, especially from unauthorized remote sessions or alongside configuration changes.

  4. Detection strategy MITRE lists

    DET0034, Detection of Adversarial Process Discovery Behavior.

How to defend

  1. Accept limited prevention

    MITRE states this technique cannot easily be mitigated with preventive controls because it abuses normal system features.

  2. Monitor and correlate

    Collect command and process telemetry, and link process listing to other signs of intrusion, since on its own it is common and low risk.

Questions

What is Process Discovery (T1057)?

Process Discovery is a Discovery technique where attackers list the programs running on a system. The result shows what software and tools are active and helps them decide what to do next.

Why do attackers list running processes?

After gaining a foothold, attackers want to understand the system. The process list can shape their next steps in automated discovery, for example whether to fully infect the target or to try specific actions.

Which systems does Process Discovery affect?

MITRE notes that built-in commands, scripting tools and system programming interfaces can return process information on Windows, Mac, Linux, ESXi and network devices. Administrator or other elevated access may give better process details.

How can defenders detect Process Discovery?

Watch for commands or system calls that list active processes when they come from an unusual parent process, a remote session or a script. Correlate process listing with interactive shells and user roles, and monitor ESXi hosts and network devices.

Can Process Discovery be prevented?

Not easily. MITRE states this technique cannot easily be mitigated with preventive controls because it abuses normal system features. Collect command and process telemetry and link process listing to other signs of intrusion, since on its own it is common and low risk.

In our research

  1. KageNoHitobito Ransomware Technical Analysis August 2024
  2. Stone Gaze: In-Depth Analysis of Medusa Ransomware July 2024
  3. [Research Summary]: RokRat June 2024
  4. Xeno RAT Technical Analysis June 2024
  5. Cactus Ransomware Technical Analysis March 2024
  6. [Research Summary]: Stop/Djvu Ransomware October 2023

Sources

  1. MITRE ATT&CK T1057: Process Discovery MITRE
  2. MITRE ATT&CK Tactic TA0007: Discovery MITRE

Browse the threat library

Keep exploring

Knowledge Hub

Glossary term

MITRE ATT&CK

MITRE ATT&CK is a globally-accessible knowledge base of adversary tactics and techniques based on real-world observations.

Read more