Process Discovery

What is Process Discovery?

Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully invests in a compromise. Enumerating running processes helps attackers understand what security tools are installed and running, identify application servers and databases as lateral movement targets, and find processes to inject into for defense evasion. On Windows, tasklist.exe and the Get-Process PowerShell cmdlet are commonly used, while ps and /proc filesystem enumeration are used on Linux. Security-conscious attackers use process discovery to identify and selectively terminate security tools before performing sensitive operations and to understand which processes represent high-value injection targets for defense evasion.

“Process Discovery is documented as technique T1057 in the MITRE ATT&CK knowledge base under the Discovery tactic. Detection requires visibility into XDR, SIEM telemetry.”

Detection Strategies

The following detection strategies help SOC analysts identify Process Discovery activity. These methods apply across XDR, SIEM environments and can be implemented as detection rules, correlation queries, or behavioral analytics in your security platform.

1. 1

   Monitor for execution of process enumeration commands including tasklist.exe, wmic process list, and Get-Process from non-administrative accounts or from processes that do not normally perform process enumeration.

2. 2

   Alert on process enumeration followed immediately by process termination targeting security tools, as attackers typically enumerate processes to identify security software before attempting to disable or terminate it.

3. 3

   Detect automated process enumeration tools that query the Windows process list or Linux procfs at high frequency, which is a signature of post-exploitation framework functionality performing environment reconnaissance.

4. 4

   Monitor for cross-process queries using OpenProcess with PROCESS_QUERY_INFORMATION access rights against many processes in rapid succession, as this is the API-based equivalent of running tasklist and provides more detailed process information.

5. 5

   Track process enumeration events on sensitive systems including domain controllers and database servers, as attackers targeting these systems perform process discovery to understand running services before attempting exploitation or disruption.

Example Alerts

These realistic alert examples show what Process Discovery looks like in your security tools. Use them to tune detection rules and train analysts to recognize true positives versus false positives in live environments.

Frequently Asked Questions

How do SOC analysts detect Process Discovery?

SOC analysts detect Process Discovery (T1057) by monitoring XDR, SIEM telemetry for behavioral anomalies and specific indicators. Key detection methods include monitor for execution of process enumeration commands including tasklist.exe, wmic process list, and get-process from non-administrative accounts or f. SOCSimulator provides hands-on practice detecting this technique with realistic alerts.

What security tools are used to detect Process Discovery?

Process Discovery can be detected using XDR, SIEM platforms. XDR tools are particularly effective for this technique because they provide visibility into the discovery phase of the attack chain. SOCSimulator simulates all three tool types for hands-on training.

How common is Process Discovery in real-world attacks?

Process Discovery is a well-documented MITRE ATT&CK technique in the Discovery tactic. It appears in threat intelligence reports from multiple security vendors and has been observed in campaigns by various threat actor groups. SOCSimulator includes realistic Process Discovery scenarios based on documented attack patterns, helping analysts build detection intuition.

Can I practice detecting Process Discovery for free?

Yes. SOCSimulator offers free forever access to training scenarios, including Discovery techniques like Process Discovery. You can investigate realistic alerts in guided Operations rooms, build detection skills with SIEM, XDR, and Firewall interfaces, and test yourself under pressure in Shift Mode. No credit card required.