Process Discovery

What is Process Discovery?

“Process Discovery is documented as technique T1057 in MITRE ATT&CK® v19.1 under the Discovery tactic. Detection requires visibility into XDR, SIEM telemetry.”

Detection Strategies

The following detection strategies help SOC analysts identify Process Discovery activity. These methods apply across XDR, SIEM environments and can be implemented as detection rules, correlation queries, or behavioral analytics in your security platform.

1. 1

   Monitor for execution of process enumeration commands including tasklist.exe, wmic process list, and Get-Process from non-administrative accounts or from processes that do not normally perform process enumeration.

2. 2

   Alert on process enumeration followed immediately by process termination targeting security tools, as attackers typically enumerate processes to identify security software before attempting to disable or terminate it.

3. 3

   Detect automated process enumeration tools that query the Windows process list or Linux procfs at high frequency, which is a signature of post-exploitation framework functionality performing environment reconnaissance.

4. 4

   Monitor for cross-process queries using OpenProcess with PROCESS_QUERY_INFORMATION access rights against many processes in rapid succession, as this is the API-based equivalent of running tasklist and provides more detailed process information.

5. 5

   Track process enumeration events on sensitive systems including domain controllers and database servers, as attackers targeting these systems perform process discovery to understand running services before attempting exploitation or disruption.

Example Alerts

These realistic alert examples show what Process Discovery looks like in your security tools. Use them to tune detection rules and train analysts to recognize true positives versus false positives in live environments.

Frequently Asked Questions

How do SOC analysts detect Process Discovery?

Detection centers on XDR, SIEM telemetry for the discovery phase of the attack. Monitor for execution of process enumeration commands including tasklist.exe, wmic process list, and Get-Process from non-administrative accounts or from processes that do not normally perform process enumeration. Alert on process enumeration followed immediately by process termination targeting security tools, as attackers typically enumerate processes to identify security software before attempting to disable or terminate it.

What does a Process Discovery alert look like?

A representative XDR detection is "Security Tool Discovery Preceding Defense Evasion" (high severity): Tasklist.exe executed and output filtered for security product process names including defender, edr, sentinel, crowdstrike, and carbon. Immediately following this discovery step, sc.exe stop and taskkill commands targeted the identified security processes. This deliberate enumeration before targeted termination of security tools is a characteristic pre-execution step in ransomware and sophisticated APT operations.

Which tools detect Process Discovery, and how can I practice?

Process Discovery (T1057) is best surfaced with XDR, SIEM telemetry, which exposes the discovery signals described above. Practice detecting it on those exact consoles in SOCSimulator Operations, free.