T1057 Process Discovery: Detecting Process Listing Before EDR Tampering and Credential Theft

Before an attacker kills your EDR agent, dumps LSASS or decides whether a host is worth encrypting, they list its running processes, and that listing is one of the earliest moments you can catch them. MITRE ATT&CK tracks this as T1057 Process Discovery, a Discovery (TA0007) technique with no sub-techniques, on ESXi, Linux, macOS, Network Devices and Windows. ATT&CK notes that attackers use the results to shape follow-on behaviour, including whether to fully infect the target. This guide is for detection engineers, threat hunters and endpoint teams: how the technique is used in real intrusions, the telemetry that separates it from normal administration, and the hardening that makes the processes attackers look for harder to touch. For the tampering step that often follows, see the EDR Evasion and Defence Guide.

Key takeaways

• It is a decision point for the attacker. Process lists tell malware whether security tools, rival malware, databases or credential stores are present, and many families change behaviour based on the answer.
• The command is common; the context is not. tasklist, Get-Process and ps run all day. Detection works on parent process, user, timing and what follows.
• API-based listing bypasses command rules. ATT&CK names CreateToolhelp32Snapshot and reading /proc; malware that uses them never launches a discovery binary.
• Harden the targets, not the listing. ATT&CK v20 lists no mitigations for T1057. Value comes from protecting what attackers find: LSA protection, tamper protection, and /proc visibility limits on Linux.
• Hypervisors and devices are in scope. ESXi (esxcli system process list) and router show processes commands appear in real intrusions and are rarely logged centrally.

What the technique is

ATT&CK v20 (technique version 1.6, last modified 11 September 2026) describes adversaries getting information about running processes to understand the software in use. It names these sources:

A closely related technique, T1518.001 Security Software Discovery, covers looking specifically for security products, and T1010 Application Window Discovery covers listing open windows. Both have their own ATT&CK pages; in practice malware often does all three in one routine.

How adversaries use it: real cases

The v20 data links T1057 to more groups and software than almost any other discovery technique. Each case below is an ATT&CK procedure example with its source as cited by ATT&CK.

For the Storm-0501 identity and cloud chain that followed its on-premises discovery, see the Storm-0501 Hybrid Cloud Attacks 2024 breach analysis.

What attackers look for in a process list

• Security agents: EDR, antivirus and cloud workload agents, to decide whether to tamper with them (see T1685 Disable or Modify Tools) or to stay quiet.
• LSASS and credential holders: the process ID of lsass.exe is the input for T1003.001 LSASS Memory; password manager, SSH agent and browser processes indicate other credential stores worth targeting.
• Databases and business applications: ransomware stops these before encryption so files are not locked (Apostle malware in the v20 data stops services containing "sql").
• Analysis tools and sandboxes: debuggers and monitoring tools suggest a lab, and some malware exits.
• Injection hosts: long-lived, trusted processes such as explorer.exe (the APT28 loader in the v20 data searches for it) to hide in.

What to detect and where

ATT&CK detection strategy DET0034 (Detection of Adversarial Process Discovery Behavior) defines one analytic per platform.

Sequences worth alerting on

• Listing then handle to LSASS: Tasklist or PowerShell process listing followed within minutes by Sysmon event 10 with TargetImage of lsass.exe from a non-security process. Microsoft notes event 10 can be high volume and should be filtered to remove expected accesses.
• Listing then security service change: a process listing followed by attempts to stop security services, unload drivers or change exclusions.
• Filtered listings: command lines piping process output through findstr or grep for security product or database names.
• Discovery burst: process listing within a cluster of user, network and system discovery from the same parent in a short window.
• Service account context: a process listing run by a service account or workload identity that never runs interactive commands.

API-based enumeration needs EDR telemetry or behavioural rules from your endpoint product; native Windows logs do not record a CreateToolhelp32Snapshot call.

Hardening the processes attackers hunt for

ATT&CK v20 lists no mitigation objects for T1057. The controls below are NHI Mgmt Group recommendations that limit what an attacker can do with the list, drawn from vendor and kernel documentation.

See Credential Guard and VBS, App Control for Business (WDAC) and the Bring Your Own Vulnerable Driver and EDR Killers Guide for the deep detail.

Where identity fits

Process lists matter for identity because they reveal where secrets live in memory: LSASS for domain credentials, SSH agents for keys, CI runners and service processes holding tokens and API keys in environment variables. On Linux, with default /proc settings, the cmdline and status files of other users' processes are readable, so a secret passed as a command line argument to a service is visible to any local account. Pass secrets through files or a secrets manager rather than arguments, and treat a process listing run from a service account as a priority alert. See the T1003 OS Credential Dumping guide for the follow-on step.

How to test and measure

1. Check prerequisites: command line capture (4688 with command line or Sysmon 1), PowerShell script block logging, and Sysmon 10 with a filter that keeps LSASS access.
2. Emulate safely: an authorised tester runs a process listing from an unusual parent on a test host, then opens a read handle to a benign process, using an emulation framework mapped to T1057.
3. Verify sequences fire: the listing alone should reach hunting; the listing followed by LSASS access should alert.
4. Pilot hardening: enable LSA protection in audit mode first (Microsoft documents AuditLevel 8 and CodeIntegrity events 3065 and 3066) to find incompatible plug-ins before enforcing.
5. Roll back: if a monitoring tool breaks under hidepid, add it to the gid= group rather than remounting /proc openly.

Metrics

• Percentage of Windows hosts with LSA protection enforced (WinInit event 12 confirms protected start).
• Percentage of hosts with tamper protection on.
• DET0034 analytics implemented and tested, out of five.
• Mean time from process listing plus LSASS access to containment.
• Linux servers mounting /proc with hidepid.

Common failure patterns

• Single-command alerts: alerting on every tasklist produces thousands of events and trains analysts to ignore the rule.
• Trusting command rules alone: API-based listing, used by ransomware such as Ryuk, never spawns a discovery binary.
• Dropping Sysmon 10 for volume: removing process access events entirely loses the LSASS signal; filter instead.
• Secrets in command lines: tokens passed as arguments appear in every process listing and in your own logs.
• Blind hypervisors: ESXi shell activity is not forwarded, so UNC3886-style guest process listing goes unseen.

Framework mapping

Practitioner checklist

• Capture command lines and PowerShell script blocks on all Windows hosts.
• Keep Sysmon event 10 for lsass.exe with expected accessors filtered out.
• Correlate process listing with LSASS access and security service changes.
• Enforce LSA protection after an audit-mode pilot.
• Turn on tamper protection for your endpoint agent and alert on changes.
• Mount /proc with hidepid on multi-user Linux servers.
• Remove secrets from process command lines.
• Forward ESXi shell and network device command logs to the SIEM.

Standards and references

• MITRE ATT&CK: Process Discovery (T1057)
• MITRE ATT&CK: Tasklist (S0057)
• MITRE ATT&CK: Security Software Discovery (T1518.001)
• Microsoft: Configure added LSA protection
• Microsoft: Protect security settings with tamper protection
• Microsoft: Sysmon
• Linux kernel documentation: The /proc filesystem
• NIST: SP 800-53 Rev. 5 Security and Privacy Controls

Related NHI Mgmt Group resources: EDR Evasion and Defence Guide · T1055 Process Injection Defensive Guide · EDR Tampering and BYOVD Response Playbook · Discovery and Reconnaissance Techniques Guide