Process reconnaissance is the identification and inspection of running processes on a system or within an application environment. It is used to map what is executing, which users or services own it, and what command line, modules, ports or privileges are associated with it, helping defenders spot unexpected processes and attackers find useful targets.
How process reconnaissance works
Process reconnaissance is the act of enumerating active processes to understand what is running, who launched it, and how it is behaving. The same basic check can reveal normal application activity, hidden services, unusual command lines, or suspicious privilege use, so it is useful both during hardening and during incident response.
Because processes are live execution objects, the value is in context as much as in the process name. A benign-sounding binary may be far more informative when paired with its parent process, user context, open ports, loaded modules, or the account it runs under.
What defenders learn from process inspection
For defenders, process reconnaissance helps separate expected execution from drift. It can show whether a system is running software that does not belong there, whether a service has been launched with excessive rights, or whether command-line arguments expose risky behaviour such as embedded secrets or unusual remote access parameters.
It also helps explain exposure. A process that listens on a network port, loads a suspicious library, or runs under an unexpected account may be the first visible sign that an endpoint or application host has changed state in a way that deserves investigation.
How attackers use process reconnaissance
Attackers use process reconnaissance to identify high-value targets and adapt their next move. They look for security tools to evade, browsers and email clients for token theft, database or backup services for data access, and administrative utilities that can be abused for privilege escalation or lateral movement.
This is especially useful after initial access, when process visibility tells an attacker which techniques are likely to work and which noisy actions may trigger detection. In practice, process inspection often supports both discovery and post-compromise decision-making.
For a broader view of reconnaissance as an adversary activity and how it fits into attack paths, see MITRE ATT&CK Enterprise Matrix.
Signals, controls and investigation context
Process reconnaissance is most useful when it is correlated with process lineage, logon context, integrity level, module loading, network connections and hash or reputation data. On modern endpoints, defenders usually need more than a snapshot because short-lived or injected processes can disappear before a manual review catches them.
When a process looks abnormal, the next question is not just what it is, but whether it should exist at all on that host. That makes asset inventory, baseline processes and alerting on unusual parents, children and command lines important parts of the investigation workflow.
For control mapping around logging, monitoring and system integrity checks, NIST SP 800-53 Rev 5 Security and Privacy Controls provides a useful control reference, while NIST Cybersecurity Framework 2.0 helps organise detection and response around the host's observed state.
OSINT and reconnaissance footprint reduction
Process reconnaissance is usually performed on a live system, but the same mindset applies to reducing what an attacker can learn before they ever gain access. The less exposed your environment is through public repositories, asset leakage, certificates, DNS, or over-shared technical detail, the less useful external reconnaissance becomes as a precursor to process-level discovery.
That is why defensive reconnaissance work often extends beyond one machine. It includes understanding the broader footprint an attacker can map before they reach a host, then reducing that visibility where it creates unnecessary risk.
NHIMG's OSINT and Reconnaissance Guide covers the wider exposure surface that can make downstream process discovery easier for an attacker.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5, NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | TA0043 — Reconnaissance | Process reconnaissance is an adversary discovery activity within ATT&CK reconnaissance. |
| Recommendation — Map observed process discovery activity to reconnaissance behavior and correlate it with later attack stages. | ||
| NIST SP 800-53 Rev 5 | AU-6 — Audit Record Review, Analysis, and Reporting | Process inspection depends on reviewing host telemetry and correlating process events. |
| SI-4 — System Monitoring | Process monitoring is a core system integrity and detection function for active execution on hosts. | |
| Recommendation — Review process telemetry for unusual parents, command lines, and execution context. Monitor running processes, connections, and loaded modules for suspicious changes. | ||
| NIST CSF 2.0 | DE.CM-01 — The network and systems of interest are monitored to find potential cybersecurity events | Process reconnaissance depends on monitoring systems to identify unexpected execution. |
| Recommendation — Continuously monitor host processes and alert on deviations from baseline. | ||
| CIS Controls v8 | CIS-8 — Audit Log Management | Process investigation relies on preserved telemetry for execution and lineage analysis. |
| Recommendation — Centralise process and execution logs so analysts can reconstruct suspicious activity. | ||
Related resources from NHI Mgmt Group
- Why do NHI programmes need stronger process ownership than many human identity programmes?
- How should organisations govern API partner onboarding as a non-human identity process?
- How can security teams apply GRC maturity benchmarks without creating process bloat?
- Should organisations use the same process for onboarding people and machine identities?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on November 2, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org