Skip to content
Sign In
Learn

T1057

Process Discovery

What it is

Attackers list the programs running on a host to learn what it does and which security tools are watching it. It is a technique under the Discovery tactic. A process listing often comes just before an attempt to stop or avoid an antivirus, endpoint agent or backup service, so it can warn of what the attacker plans next.

How adversaries use it

The attacker runs built-in commands such as tasklist on Windows, ps on Linux, or Get-Process in PowerShell, sometimes with options that show each process's account or services. They read the list for security products, remote access tools and applications worth targeting, then choose what to stop, avoid or inject into.

Detect it in Elastic

Data source: Windows and Linux process creation events

Key fields

event.code: 1 (Sysmon) or 4688 (Windows Security) on Windows; event.action: executed on Linux (Auditbeat) process.name: the listing tool, such as tasklist.exe or ps process.command_line (Windows) or process.args (Linux): the options used process.parent.name: what started it (on Linux, Elastic Defend only; Auditbeat records only the parent's process ID) user.name: the account that ran it host.name, @timestamp

Example event

{
  "host": {
    "name": "ws-214.corp.example"
  },
  "user": {
    "name": "m.castell"
  },
  "event": {
    "code": "1"
  },
  "process": {
    "name": "tasklist.exe",
    "parent": {
      "name": "wscript.exe"
    },
    "command_line": "tasklist /v"
  },
  "@timestamp": "2026-05-14T09:34:12.477Z"
}

Prebuilt Elastic rule: Process Discovery Using Built-in Tools

Hunt guidance

Start with process listings: process.name: "tasklist.exe" or (process.name: "ps" and process.args: "aux"). Then look at what the same account did in the next few minutes. Look for a listing followed by an attempt to stop a security product or service, a listing run by a script or a remote session rather than a person at the keyboard, and listings in a burst with other discovery commands.

Ruling out legitimate activity

Support staff, administrators and monitoring tools list processes routinely. Check whether the account normally troubleshoots hosts, whether the parent is an expected tool, and what followed. A listing on its own is weak evidence; a listing followed by a security tool stopping is strong.

Telemetry needed

The log events that help detect this technique, from the Telemetry reference: which log source to collect, which event in it, and how to enable each one.

References

Practice it

No range covers this technique yet; the write-up above landed first. Ranges are added continuously; the ones live today are on the training ladder.