T1057: Process Discovery
Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Administrator or otherwise elevated access may provide better process details. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
In Windows environments, adversaries could obtain details on running processes using the Tasklist utility via cmd or Get-Process via PowerShell. Information about processes can also be extracted from the output of Native API calls such as CreateToolhelp32Snapshot. In Mac and Linux, this is accomplished with the ps command. Adversaries may also opt to enumerate processes via `/proc`. ESXi also supports use of the `ps` command, as well as `esxcli system process list`.[1][2]
On network devices, Network Device CLI commands such as `show processes` can be used to display current running processes.[3][4]
Analyst context for executives and security teams
Process Discovery is an early reconnaissance behavior where an adversary checks what is running on Windows, Linux, macOS, ESXi, or network devices before deciding what to do next. For leaders, its value is not that a process listing is inherently malicious; it is that this behavior often helps an intruder identify security tools, business applications, virtualization hosts, and device services that can shape follow-on actions. Coverage matters because missed process discovery can leave SOC and IR teams without context for how an intrusion was scoped and prepared.
Executive priority
Treat this as a baseline visibility and response-readiness control, not a standalone high-severity alert. Executives should ask whether endpoints, ESXi hosts, and network devices generate enough command, process, and administrative-session evidence to prove what was enumerated during an incident. This is especially relevant for operational resilience where ESXi or network devices support critical services, and for audit/compliance evidence where teams must reconstruct attacker discovery activity.
Technical view
ATT&CK lists Process Discovery under Discovery across ESXi, Linux, macOS, Network Devices, and Windows. Validate visibility for common process-enumeration paths described by MITRE: Windows Tasklist through cmd, PowerShell Get-Process, Native API process snapshot activity, ps and /proc access on Unix-like systems, ESXi ps and esxcli system process list, and network device CLI commands such as show processes. Because MITRE provides no official detection text for this object, detection engineering should lean on relationship context from DET0034 and local baselines: focus on unusual users, remote sessions, suspicious parent processes, automation, post-compromise tool chains, and discovery clustered with other ATT&CK behaviors.
Likely telemetry
- Endpoint process creation events with command-line arguments
- PowerShell execution and script logging where available
- Windows command shell activity involving process listing utilities
- API or EDR telemetry indicating process enumeration behavior
- Linux, macOS, and ESXi shell command history or audit logs for ps, /proc access, and esxcli process listing
Detection direction
- Do not alert on every process listing in isolation; tune around context such as uncommon account, host, parent process, remote source, time of day, or proximity to other discovery and execution activity.
- Build separate baselines for servers, admin workstations, ESXi hosts, and network devices because legitimate administrative process checks are common.
- Prioritize correlation where process discovery follows suspicious execution or precedes credential, defense-evasion, lateral movement, or ransomware-like activity.
- Validate that DET0034 or equivalent analytic coverage is mapped to this technique and tested with benign simulations in each supported platform class.
- Check blind spots around ESXi shell access, network device CLI logging, PowerShell visibility, and Linux/macOS audit coverage; these are often less complete than standard Windows endpoint logs.
Mitigation priorities
- Ensure least-privilege administration so elevated process details are limited to authorized users and sessions.
- Centralize and retain endpoint, ESXi, Linux/macOS, and network device administrative telemetry for incident reconstruction.
- Harden and monitor remote administrative access paths used to run process discovery commands.
- Use detection tuning and response playbooks that treat process discovery as a contextual signal rather than a guaranteed malicious event.
- For critical infrastructure or cyber-physical environments, confirm that virtualization hosts and network infrastructure supporting operations are included in logging and IR collection plans.
Analyst notes and limits
The relationship set shows this technique is used across many campaigns and groups, including espionage, ransomware, supply-chain, botnet, and network-device activity. That breadth supports prioritizing visibility, but it should not be interpreted as attribution in a local incident. The most defensible use of this technique in operations is as a correlation and scoping signal: who enumerated processes, on which platform, from what session, and what happened before and after.
MITRE did not provide official detection guidance for T1057 in the supplied object. Specific commands and telemetry availability vary by operating system, device type, EDR/audit configuration, and administrative practice. This take does not assert active exploitation, customer exposure, or guaranteed detection coverage.
Process Discovery
Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Administrator or otherwise elevated access may provide better process details. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
In Windows environments, adversaries could obtain details on running processes using the Tasklist utility via cmd or Get-Process via PowerShell. Information about processes can also be extracted from the output of Native API calls such as CreateToolhelp32Snapshot. In Mac and Linux, this is accomplished with the ps command. Adversaries may also opt to enumerate processes via `/proc`. ESXi also supports use of the `ps` command, as well as `esxcli system process list`.[1][2]
On network devices, Network Device CLI commands such as `show processes` can be used to display current running processes.[3][4]
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Groups, software, and campaigns
G1054: MirrorFace
MirrorFace is a People's Republic of China (PRC)-aligned cyberespionage actor believed to be a subgroup under the menuPass umbrella based on targeting, tools, and infrastructure overlaps. MirrorFace has been active since at least 2019, at first exclusively targeting Japanese organizations across the media, defense, diplomatic, financial, manufacturing, and academic sectors. Subsequent MirrorFace operations included targets in Central Europe and featured use of LODEINFO, HiddenFace, and UPPERCUT malware.[1][2][3][4][5][6]
G0112: Windshift
G1017: Volt Typhoon
Volt Typhoon is a People's Republic of China (PRC) state-sponsored actor that has been active since at least 2021, primarily targeting critical infrastructure organizations in the US and its territories including Guam. Volt Typhoon's targeting and pattern of behavior have been assessed as pre-positioning to enable lateral movement to operational technology (OT) assets for potential destructive or disruptive attacks. Volt Typhoon has emphasized stealth in operations using web shells, living-off-the-land (LOTL) binaries, hands on keyboard activities, and stolen credentials.[1][2][3][4]. The group has leveraged compromised SOHO routers to proxy command and control traffic and obscure its infrastructure, activity associated with the KV botnet.[5].
Reporting indicates a separate initial access cluster, SYLVANITE, has been observed exploiting internet-facing edge devices and transferring access to Volt Typhoon, also tracked as VOLTZITE, for follow-on operations. [6]
G0081: Tropic Trooper
Tropic Trooper is an unaffiliated threat group that has led targeted campaigns against targets in Taiwan, the Philippines, and Hong Kong. Tropic Trooper focuses on targeting government, healthcare, transportation, and high-tech industries and has been active since 2011.[1][2][3]
G0121: Sidewinder
Sidewinder is a suspected Indian threat actor group that has been active since at least 2012. They have been observed targeting government, military, and business entities throughout Asia, primarily focusing on Pakistan, China, Nepal, and Afghanistan.[1][2][3]
G0009: Deep Panda
Deep Panda is a suspected Chinese threat group known to target many industries, including government, defense, financial, and telecommunications. [1] The intrusion into healthcare company Anthem has been attributed to Deep Panda. [2] This group is also known as Shell Crew, WebMasters, KungFu Kittens, and PinkPanther. [3] Deep Panda also appears to be known as Black Vine based on the attribution of both group names to the Anthem intrusion. [4] Some analysts track Deep Panda and APT19 as the same group, but it is unclear from open source information if the groups are the same. [5]
G0006: APT1
S0091: Epic
S9024: SPAWNCHIMERA
SPAWNCHIMERA is a backdoor that supports command and control and can inject malicious components into native processes.[1][2][3] SPAWNCHIMERA It incorporates capabilities from multiple tools within the SPAWN malware family, including SPAWNANT, SPAWNMOLE, and SPAWNSNAIL.[4][2][3] SPAWNCHIMERA was first reported in April 2024.[2] SPAWNCHIMERA has been observed in activity attributed to People's Republic of China (PRC) state-sponsored threat actors, including UNC5221..[4][5][2][6]
S0670: WarzoneRAT
WarzoneRAT is a malware-as-a-service remote access tool (RAT) written in C++ that has been publicly available for purchase since at least late 2018.[1][2]
S0267: FELIXROOT
S9020: LODEINFO
LODEINFO is a fileless backdoor malware first identified in 2020 that has been used by actors including MirrorFace, primarily against media, diplomatic, governmental, and public sector organizations in Japan.[1][2][3]
S0562: SUNSPOT
S9012: TRAILBLAZE
TRAILBLAZE is an in-memory dropper used to deploy the passive backdoor BRUSHFIRE. First reported in March 2025, TRAILBLAZE has been observed in operations attributed to People's Republic of China (PRC) state-sponsored affiliated actors, including UNC5221 and SYLVANITE. [1][2][3]
S0142: StreamEx
StreamEx is a malware family that has been used by Deep Panda since at least 2015. In 2016, it was distributed via legitimate compromised Korean websites. [1]
S9019: PureCrypter
PureCrypter is a fully-featured malware loader, developed by a threat actor called “PureCoder," that has been in use since at least 2021 to distribute a variety of remote access trojans and information stealers.[1]
S0456: Aria-body
S0149: MoonWind
S0251: Zebrocy
C0056: RedPenguin
The RedPenguin project was launched by Juniper in July 2024 to investigate reported malware infections of Juniper MX Series routers. RedPenguin activity was separately attributed to UNC3886 and included the deployment of multiple custom versions of the publicly-available TINYSHELL backdoor on Juniper routers.[1][2]
C0001: Frankenstein
Frankenstein was described by security researchers as a highly-targeted campaign conducted by moderately sophisticated and highly resourceful threat actors in early 2019. The unidentified actors primarily relied on open source tools, including Empire. The campaign name refers to the actors' ability to piece together several unrelated open-source tool components.[1]
C0024: SolarWinds Compromise
The SolarWinds Compromise was a sophisticated supply chain cyber operation conducted by APT29 that was discovered in mid-December 2020. APT29 used customized malware to inject malicious code into the SolarWinds Orion software build process that was later distributed through a normal software update; they also used password spraying, token theft, API abuse, spear phishing, and other supply chain attacks to compromise user accounts and leverage their associated access. Victims of this campaign included government, consulting, technology, telecom, and other organizations in North America, Europe, Asia, and the Middle East. This activity has been labled the StellarParticle campaign in industry reporting.[1] Industry reporting also initially referred to the actors involved in this campaign as UNC2452, NOBELIUM, Dark Halo, and SolarStorm.[2][3][4][5][1][6][7][8]
In April 2021, the US and UK governments attributed the SolarWinds Compromise to Russia's Foreign Intelligence Service (SVR); public statements included citations to APT29, Cozy Bear, and The Dukes.[9][10][11] The US government assessed that of the approximately 18,000 affected public and private sector customers of Solar Winds’ Orion product, a much smaller number were compromised by follow-on APT29 activity on their systems.[12]
All related ATT&CK context
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .
Imported snapshots across ATT&CK releases (1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 1.6 | Current bundle | e747615d5bfc… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
-
[1]
Sygnia ESXi Ransomware 2025
Zhongyuan Hau (Aaron), Ren Jie Yow, and Yoav Mazor. (2025, January 21). ESXi Ransomware Attacks: Stealthy Persistence through. Retrieved March 27, 2025.
Open source URL -
[2]
Crowdstrike Hypervisor Jackpotting Pt 2 2021
Michael Dawson. (2021, August 30). Hypervisor Jackpotting, Part 2: eCrime Actors Increase Targeting of ESXi Servers with Ransomware. Retrieved March 26, 2025.
Open source URL -
[3]
US-CERT-TA18-106A
US-CERT. (2018, April 20). Alert (TA18-106A) Russian State-Sponsored Cyber Actors Targeting Network Infrastructure Devices. Retrieved October 19, 2020.
Open source URL -
[4]
show_processes_cisco_cmd
Cisco. (2022, August 16). show processes - . Retrieved July 13, 2022.
Open source URL -
[5]
mitre-attack T1057Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.