Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
In Windows environments, adversaries could obtain details on running processes using the Tasklist utility via cmd or Get-Process
via PowerShell. Information about processes can also be extracted from the output of Native API calls such as CreateToolhelp32Snapshot
. In Mac and Linux, this is accomplished with the ps
command. Adversaries may also opt to enumerate processes via /proc.
2022-05-03