Which SIEM platforms have a T1057 detection rule?

df00tech provides T1057 (Process Discovery) detection queries for 7 SIEM platforms: Microsoft Sentinel / Defender, Splunk, Elastic Security (EQL), IBM QRadar (AQL), Sumo Logic CSE, Google Chronicle / SecOps, CrowdStrike LogScale (CQL).

What data sources are required to detect Process Discovery (T1057)?

Detecting Process Discovery requires the following data sources: Process: Process Creation, Command: Command Execution, Microsoft Defender for Endpoint.

What severity and confidence is the T1057 detection?

The T1057 detection is rated low severity with medium confidence.

What are common false positives for T1057?

Common false positives for T1057 include: IT administrators running tasklist or wmic process get for inventory, troubleshooting, or performance monitoring; Endpoint Detection and Response (EDR) agents, antivirus software, and monitoring tools (Datadog, SolarWinds, Nagios) that periodically enumerate processes as part of their normal operation; Software installers and update mechanisms that check for conflicting processes before installation or during version upgrades.

T1057

Process Discovery

Discovery Last updated: April 16, 2026

Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software and applications running on systems within the network. In Windows environments, adversaries use tools such as tasklist.exe, wmic process, and PowerShell Get-Process to enumerate running processes. On Linux and macOS, the ps command and /proc filesystem are used. ESXi supports ps and esxcli system process list. This technique is frequently used during post-exploitation to identify security tools, determine if analysis environments (sandboxes, AV) are present, find target processes for injection, and shape follow-on actions. Threat actors including Volt Typhoon, Turla, and numerous RAT families (WarzoneRAT, FELIXROOT) perform process discovery as a standard reconnaissance step.

What is T1057 Process Discovery?

Process Discovery (T1057) maps to the Discovery tactic — the adversary is trying to figure out your environment in MITRE ATT&CK.

This page provides production-ready detection logic for Process Discovery, covering the data sources and telemetry it touches: Process: Process Creation, Command: Command Execution, Microsoft Defender for Endpoint. The queries below are rated low severity at medium confidence, and ship for 7 SIEM platforms — KQL, SPL, Elastic, QRadar, Sumo, YARA-L, LogScale.

MITRE ATT&CK

Tactic: Discovery
Technique: T1057 Process Discovery
Canonical reference: https://attack.mitre.org/techniques/T1057/

Microsoft Sentinel / Defender

kusto

let ProcessDiscoveryTools = dynamic(["tasklist.exe", "pslist.exe", "proclist.exe", "tlist.exe"]);
let WmicProcessPatterns = dynamic(["process get", "process list", "process where", "win32_process"]);
let SuspiciousParents = dynamic([
  "cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe",
  "mshta.exe", "rundll32.exe", "regsvr32.exe", "msbuild.exe", "installutil.exe",
  "certutil.exe", "bitsadmin.exe", "wmic.exe"
]);
DeviceProcessEvents
| where Timestamp > ago(24h)
| where (
    FileName in~ (ProcessDiscoveryTools)
    or (FileName =~ "wmic.exe" and ProcessCommandLine has_any (WmicProcessPatterns))
    or (FileName in~ ("powershell.exe", "pwsh.exe") and ProcessCommandLine has_any ("Get-Process", "get-process", "ps ", "gps ", "Get-WmiObject Win32_Process", "Get-CimInstance Win32_Process", "[System.Diagnostics.Process]::GetProcesses"))
    or (FileName =~ "ps" and InitiatingProcessFileName has_any ("bash", "sh", "zsh", "python", "python3", "perl", "ruby"))
)
| extend IsKnownBadParent = InitiatingProcessFileName has_any (SuspiciousParents)
| extend IsPowerShellDiscovery = FileName in~ ("powershell.exe", "pwsh.exe") and ProcessCommandLine has_any ("Get-Process", "Get-WmiObject Win32_Process", "Get-CimInstance Win32_Process")
| extend IsWmicDiscovery = FileName =~ "wmic.exe" and ProcessCommandLine has_any (WmicProcessPatterns)
| extend IsTasklistExec = FileName in~ (ProcessDiscoveryTools)
| extend HasVerboseFlag = ProcessCommandLine has_any ("/v", "/fo", "/svc", "ExecutablePath", "CommandLine")
| project
    Timestamp, DeviceName, AccountName, AccountDomain,
    FileName, ProcessCommandLine,
    InitiatingProcessFileName, InitiatingProcessCommandLine,
    InitiatingProcessParentFileName,
    IsKnownBadParent, IsPowerShellDiscovery, IsWmicDiscovery, IsTasklistExec, HasVerboseFlag
| sort by Timestamp desc

Detects process discovery activity using Microsoft Defender for Endpoint DeviceProcessEvents. Monitors for execution of tasklist.exe, wmic.exe with Win32_Process queries, PowerShell Get-Process/Get-WmiObject/Get-CimInstance cmdlets, and process enumeration launched from suspicious parent processes. Flags additional context indicators including verbose output flags (/v, /svc, ExecutablePath) that suggest adversaries seeking detailed process information for security tool detection or injection target selection.

low severity medium confidence

Data Sources

Process: Process Creation Command: Command Execution Microsoft Defender for Endpoint

Required Tables

DeviceProcessEvents

False Positives

IT administrators running tasklist or wmic process get for inventory, troubleshooting, or performance monitoring
Endpoint Detection and Response (EDR) agents, antivirus software, and monitoring tools (Datadog, SolarWinds, Nagios) that periodically enumerate processes as part of their normal operation
Software installers and update mechanisms that check for conflicting processes before installation or during version upgrades
Help desk and remote support tools (TeamViewer, ConnectWise, SolarWinds N-central) that use tasklist or WMI to display running applications to remote support agents
Developer tools, IDEs (Visual Studio, JetBrains), and build pipelines that enumerate processes as part of debugging, profiling, or test orchestration
Vulnerability scanners and asset management platforms running authenticated scans against endpoints

Splunk

spl

index=wineventlog (sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1)
| eval Image=lower(Image), CommandLine=lower(CommandLine), ParentImage=lower(ParentImage)
| eval IsTasklist=if(match(Image, "\\\\tasklist\.exe$"), 1, 0)
| eval IsWmicProcess=if(match(Image, "\\\\wmic\.exe$") AND match(CommandLine, "(process\s+get|process\s+list|process\s+where|win32_process)"), 1, 0)
| eval IsPSGetProcess=if((match(Image, "\\\\powershell\.exe$") OR match(Image, "\\\\pwsh\.exe$")) AND match(CommandLine, "(get-process|get-wmiobject\s+win32_process|get-ciminstance\s+win32_process|\[system\.diagnostics\.process\]::getprocesses|gps\s)"), 1, 0)
| eval IsProcessDiscovery=IsTasklist + IsWmicProcess + IsPSGetProcess
| where IsProcessDiscovery > 0
| eval SuspiciousParent=if(match(ParentImage, "(wscript\.exe|cscript\.exe|mshta\.exe|rundll32\.exe|regsvr32\.exe|msbuild\.exe|installutil\.exe|certutil\.exe|bitsadmin\.exe)"), 1, 0)
| eval VerboseEnum=if(match(CommandLine, "(/v\b|/fo|/svc|executablepath|commandline|caption,executablepath)"), 1, 0)
| eval RiskScore=IsProcessDiscovery + SuspiciousParent + VerboseEnum
| table _time, host, User, Image, CommandLine, ParentImage, ParentCommandLine, IsTasklist, IsWmicProcess, IsPSGetProcess, SuspiciousParent, VerboseEnum, RiskScore
| sort - _time

Detects process discovery activity using Sysmon Event ID 1 (Process Creation). Identifies tasklist.exe execution, wmic.exe with Win32_Process queries, and PowerShell Get-Process/Get-WmiObject invocations. Assigns a cumulative risk score based on discovery method, suspicious parent process, and verbose enumeration flags. Events spawned from scripting hosts (wscript.exe, mshta.exe) or LOLBins receive elevated risk scores, helping analysts prioritize post-exploitation activity over routine administrative use.

low severity medium confidence

Data Sources

Process: Process Creation Command: Command Execution Sysmon Event ID 1

Required Sourcetypes

XmlWinEventLog:Microsoft-Windows-Sysmon/Operational

False Positives

IT administrators running tasklist or wmic process get for inventory, troubleshooting, or performance monitoring
Endpoint Detection and Response (EDR) agents, antivirus software, and monitoring tools that periodically enumerate processes as part of their normal operation
Software installers and update mechanisms that check for conflicting processes before installation
Help desk and remote support tools that use tasklist or WMI to display running applications
Developer tools, IDEs, and build pipelines that enumerate processes during debugging or profiling
Vulnerability scanners and asset management platforms running authenticated scans

IBM QRadar (AQL)

sql

SELECT
  DATEFORMAT(starttime, 'yyyy-MM-dd HH:mm:ss') AS EventTime,
  logsourcename(logsourceid) AS LogSource,
  sourceip AS HostIP,
  username AS UserName,
  "Process Name" AS ProcessName,
  "Command" AS CommandLine,
  "Parent Process Name" AS ParentProcessName,
  CASE
    WHEN LOWER("Process Name") LIKE '%tasklist.exe%' THEN 1
    WHEN LOWER("Process Name") LIKE '%pslist.exe%' THEN 1
    WHEN LOWER("Process Name") LIKE '%proclist.exe%' THEN 1
    WHEN LOWER("Process Name") LIKE '%tlist.exe%' THEN 1
    ELSE 0
  END AS IsTasklist,
  CASE
    WHEN LOWER("Process Name") LIKE '%wmic.exe%'
      AND (LOWER("Command") LIKE '%process get%'
        OR LOWER("Command") LIKE '%process list%'
        OR LOWER("Command") LIKE '%process where%'
        OR LOWER("Command") LIKE '%win32_process%')
    THEN 1 ELSE 0
  END AS IsWmicProcess,
  CASE
    WHEN (LOWER("Process Name") LIKE '%powershell.exe%' OR LOWER("Process Name") LIKE '%pwsh.exe%')
      AND (LOWER("Command") LIKE '%get-process%'
        OR LOWER("Command") LIKE '%get-wmiobject%win32_process%'
        OR LOWER("Command") LIKE '%get-ciminstance%win32_process%'
        OR LOWER("Command") LIKE '%[system.diagnostics.process]::getprocesses%'
        OR LOWER("Command") LIKE '%gps %')
    THEN 1 ELSE 0
  END AS IsPSGetProcess,
  CASE
    WHEN LOWER("Parent Process Name") LIKE '%wscript.exe%'
      OR LOWER("Parent Process Name") LIKE '%cscript.exe%'
      OR LOWER("Parent Process Name") LIKE '%mshta.exe%'
      OR LOWER("Parent Process Name") LIKE '%rundll32.exe%'
      OR LOWER("Parent Process Name") LIKE '%regsvr32.exe%'
      OR LOWER("Parent Process Name") LIKE '%certutil.exe%'
      OR LOWER("Parent Process Name") LIKE '%bitsadmin.exe%'
    THEN 1 ELSE 0
  END AS SuspiciousParent
FROM events
WHERE
  (QIDNAME(qid) LIKE '%Process%Create%' OR eventid = 4688 OR eventid = 1)
  AND (
    LOWER("Process Name") LIKE '%tasklist.exe%'
    OR LOWER("Process Name") LIKE '%pslist.exe%'
    OR LOWER("Process Name") LIKE '%proclist.exe%'
    OR LOWER("Process Name") LIKE '%tlist.exe%'
    OR (
      LOWER("Process Name") LIKE '%wmic.exe%'
      AND (LOWER("Command") LIKE '%process get%'
        OR LOWER("Command") LIKE '%process list%'
        OR LOWER("Command") LIKE '%process where%'
        OR LOWER("Command") LIKE '%win32_process%')
    )
    OR (
      (LOWER("Process Name") LIKE '%powershell.exe%' OR LOWER("Process Name") LIKE '%pwsh.exe%')
      AND (LOWER("Command") LIKE '%get-process%'
        OR LOWER("Command") LIKE '%get-wmiobject%win32_process%'
        OR LOWER("Command") LIKE '%get-ciminstance%win32_process%'
        OR LOWER("Command") LIKE '%[system.diagnostics.process]::getprocesses%')
    )
  )
  AND LAST 24 HOURS
ORDER BY starttime DESC

Detects T1057 Process Discovery in IBM QRadar AQL by querying process creation events (Windows Event ID 4688 and Sysmon Event ID 1) for tasklist.exe, pslist.exe, wmic process enumeration, and PowerShell Get-Process/Win32_Process queries. Calculates per-row flags for process type, suspicious parent, and enriches with log source metadata.

medium severity medium confidence

Data Sources

IBM QRadar SIEM Windows Security Event Log (WinEventLog) Sysmon via Windows DSM Microsoft Windows Security Event Log DSM

Required Tables

events (QRadar normalized event store)

False Positives

Enterprise monitoring agents such as SCOM, Nagios NRPE, or Zabbix agents that enumerate processes for health checks
Software deployment tools (SCCM, Ansible, Chef) that invoke wmic or tasklist to verify installation state
Help desk remote support sessions where analysts use tasklist.exe or PowerShell Get-Process to triage user-reported issues

Sumo Logic CSE

sql

(_sourceCategory=*windows* OR _sourceCategory=*sysmon*)
| where (%"EventCode"="1" OR %"EventID"="1" OR %"EventCode"="4688")
| eval ImageLower = toLowerCase(Image)
| eval CommandLineLower = toLowerCase(CommandLine)
| eval ParentImageLower = toLowerCase(ParentImage)
| eval IsTasklist = if(ImageLower matches "*\\tasklist.exe" OR ImageLower matches "*\\pslist.exe" OR ImageLower matches "*\\proclist.exe" OR ImageLower matches "*\\tlist.exe", 1, 0)
| eval IsWmicProcess = if(ImageLower matches "*\\wmic.exe" AND (CommandLineLower matches "*process get*" OR CommandLineLower matches "*process list*" OR CommandLineLower matches "*process where*" OR CommandLineLower matches "*win32_process*"), 1, 0)
| eval IsPSGetProcess = if((ImageLower matches "*\\powershell.exe" OR ImageLower matches "*\\pwsh.exe") AND (CommandLineLower matches "*get-process*" OR CommandLineLower matches "*get-wmiobject*win32_process*" OR CommandLineLower matches "*get-ciminstance*win32_process*" OR CommandLineLower matches "*[system.diagnostics.process]::getprocesses*" OR CommandLineLower matches "*gps *"), 1, 0)
| eval IsProcessDiscovery = IsTasklist + IsWmicProcess + IsPSGetProcess
| where IsProcessDiscovery > 0
| eval SuspiciousParent = if(ParentImageLower matches "*(wscript.exe|cscript.exe|mshta.exe|rundll32.exe|regsvr32.exe|msbuild.exe|installutil.exe|certutil.exe|bitsadmin.exe)*", 1, 0)
| eval VerboseEnum = if(CommandLineLower matches "*(/v |/fo |/svc |executablepath|commandline|caption,executablepath)*", 1, 0)
| eval RiskScore = IsProcessDiscovery + SuspiciousParent + VerboseEnum
| fields _time, Computer, User, Image, CommandLine, ParentImage, ParentCommandLine, IsTasklist, IsWmicProcess, IsPSGetProcess, SuspiciousParent, VerboseEnum, RiskScore
| sort by _time desc

Detects T1057 Process Discovery in Sumo Logic by parsing Windows Sysmon (Event ID 1) or Security (Event ID 4688) process creation logs. Evaluates process names and command lines for tasklist.exe, wmic process enumeration, and PowerShell Get-Process patterns. Computes a composite risk score based on discovery type, suspicious parent process, and verbose enumeration flags.

medium severity high confidence

Data Sources

Sumo Logic Cloud SIEM Sumo Logic Installed Collector (Windows) Sysmon for Windows Windows Security Event Log

Required Tables

_sourceCategory=*windows*sysmon* _sourceCategory=*windows*security*

False Positives

Automated patch management solutions that run tasklist.exe pre/post-patch to confirm process states
Security operations teams running ad-hoc PowerShell Get-Process commands during incident triage
Application performance monitoring agents using wmic or PowerShell to collect process metrics for dashboards

Google Chronicle / SecOps

yaral

rule t1057_process_discovery {
  meta:
    author = "Detection Engineering"
    description = "Detects T1057 Process Discovery via tasklist, wmic process enumeration, PowerShell Get-Process, and ps spawned from scripting interpreters"
    mitre_attack_tactic = "Discovery"
    mitre_attack_technique = "T1057"
    mitre_attack_url = "https://attack.mitre.org/techniques/T1057/"
    severity = "MEDIUM"
    priority = "MEDIUM"

  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    $e.principal.hostname = $hostname
    (
      re.regex($e.target.process.file.full_path, `(?i)(tasklist\.exe|pslist\.exe|proclist\.exe|tlist\.exe)$`)
      or (
        re.regex($e.target.process.file.full_path, `(?i)wmic\.exe$`)
        and re.regex($e.target.process.command_line, `(?i)(process\s+get|process\s+list|process\s+where|win32_process)`)
      )
      or (
        re.regex($e.target.process.file.full_path, `(?i)(powershell\.exe|pwsh\.exe)$`)
        and re.regex($e.target.process.command_line, `(?i)(get-process|get-wmiobject\s+win32_process|get-ciminstance\s+win32_process|\[system\.diagnostics\.process\]::getprocesses|gps\s)`)
      )
      or (
        $e.target.process.file.full_path = "/usr/bin/ps"
        and re.regex($e.principal.process.file.full_path, `(?i)(bash|sh|zsh|python3?|perl|ruby)`)
      )
    )

  match:
    $hostname over 5m

  outcome:
    $risk_score = max(
      if(
        re.regex($e.principal.process.file.full_path,
          `(?i)(wscript\.exe|cscript\.exe|mshta\.exe|rundll32\.exe|regsvr32\.exe|msbuild\.exe|installutil\.exe|certutil\.exe|bitsadmin\.exe)`
        ), 50, 10
      )
    )
    $suspicious_parent = max(
      if(
        re.regex($e.principal.process.file.full_path,
          `(?i)(wscript\.exe|cscript\.exe|mshta\.exe|rundll32\.exe|regsvr32\.exe|msbuild\.exe|installutil\.exe|certutil\.exe|bitsadmin\.exe)`
        ), 1, 0
      )
    )
    $verbose_enum = max(
      if(
        re.regex($e.target.process.command_line, `(?i)(\/v\b|\/fo|\/svc|executablepath|commandline)`),
        1, 0
      )
    )
    $discovery_count = count_distinct($e.target.process.file.full_path)

  condition:
    $e
}

Google Chronicle YARA-L 2.0 rule detecting T1057 Process Discovery via tasklist.exe, pslist.exe, wmic process queries, PowerShell Get-Process/Get-WmiObject Win32_Process, and ps spawned from scripting language interpreters. Aggregates over 5-minute windows per host, computes risk score based on suspicious parent process, and tracks verbose enumeration flags using UDM event model.

medium severity high confidence

Data Sources

Google Chronicle SIEM Chronicle Unified Data Model (UDM) Windows Event Log ingested via Chronicle forwarder Sysmon via Chronicle Windows sensor CrowdStrike Falcon via Chronicle integration

Required Tables

UDM events (PROCESS_LAUNCH event type)

False Positives

IT asset management platforms performing scheduled process inventory collection across the enterprise
Vulnerability scanners that spawn PowerShell or wmic to enumerate running processes as part of authenticated scans
Container orchestration health probes or sidecar agents that regularly enumerate host processes for resource accounting

CrowdStrike LogScale (CQL)

cql

#event_simpleName = "ProcessRollup2"
| eval ImageLower = lower(ImageFileName)
| eval CommandLineLower = lower(CommandLine)
| eval ParentImageLower = lower(ParentBaseFileName)
| eval IsTasklist = if(
    match(field=ImageLower, regex="(tasklist|pslist|proclist|tlist)\\.exe$"),
    1, 0)
| eval IsWmicProcess = if(
    match(field=ImageLower, regex="wmic\\.exe$")
    AND match(field=CommandLineLower, regex="(process\\s+get|process\\s+list|process\\s+where|win32_process)"),
    1, 0)
| eval IsPSGetProcess = if(
    match(field=ImageLower, regex="(powershell|pwsh)\\.exe$")
    AND match(field=CommandLineLower, regex="(get-process|get-wmiobject.+win32_process|get-ciminstance.+win32_process|\\[system\\.diagnostics\\.process\\]::getprocesses|gps\\s)"),
    1, 0)
| eval IsProcessDiscovery = IsTasklist + IsWmicProcess + IsPSGetProcess
| where IsProcessDiscovery > 0
| eval IsSuspiciousParent = if(
    match(field=ParentImageLower, regex="(wscript|cscript|mshta|rundll32|regsvr32|msbuild|installutil|certutil|bitsadmin)\\.exe"),
    1, 0)
| eval IsVerboseEnum = if(
    match(field=CommandLineLower, regex="(\\/v\\b|\\/fo|\\/svc|executablepath|commandline)"),
    1, 0)
| eval RiskScore = IsTasklist + IsWmicProcess + IsPSGetProcess + IsSuspiciousParent + IsVerboseEnum
| table
    @timestamp,
    ComputerName,
    UserName,
    ImageFileName,
    CommandLine,
    ParentBaseFileName,
    ParentCommandLine,
    IsTasklist,
    IsWmicProcess,
    IsPSGetProcess,
    IsSuspiciousParent,
    IsVerboseEnum,
    RiskScore
| sort type=string asc @timestamp

CrowdStrike Falcon LogScale (CQL) detection for T1057 Process Discovery using ProcessRollup2 events from the Falcon sensor. Evaluates ImageFileName and CommandLine for tasklist.exe, pslist.exe, wmic process enumeration, and PowerShell Get-Process/Get-WmiObject Win32_Process patterns. Enriches results with suspicious parent process and verbose enumeration flags and calculates a composite risk score.

medium severity high confidence

Data Sources

CrowdStrike Falcon Platform CrowdStrike Falcon LogScale (Humio) Falcon sensor ProcessRollup2 events

Required Tables

ProcessRollup2 (Falcon event stream)

False Positives

CrowdStrike Falcon RTR (Real Time Response) sessions where analysts run tasklist or PowerShell Get-Process during active investigations
Enterprise endpoint management tools (Tanium, BigFix) that execute wmic or PowerShell process queries for compliance reporting
Developer workstations running PowerShell scripts that include Get-Process to check for conflicting services before builds or deployments

Sigma rule & cross-platform mapping

The detection logic for Process Discovery (T1057) above is provided in a vendor-neutral form so you can deploy it on any SIEM. The same logic is shipped here as native KQL (Microsoft Sentinel / Defender), SPL (Splunk), Elastic (Elastic Security (EQL)), QRadar (IBM QRadar (AQL)), Sumo (Sumo Logic CSE), YARA-L (Google Chronicle / SecOps), LogScale (CrowdStrike LogScale (CQL)) queries. In Sigma terms, this detection targets the following logsource:

logsource:
  category: process_creation
  product: windows

Browse the community-maintained Sigma rules for this technique:

SigmaHQ rules for T1057 Sigma rules on detection.fyi

Platform-specific guides for T1057

Detect in Microsoft Sentinel (KQL) Detect in Splunk (SPL) Detect in Elastic Security (Elastic) Detect in IBM QRadar (QRadar) Detect in Sumo Logic CSE (Sumo) Detect in Google Chronicle (YARA-L) Detect in CrowdStrike LogScale (LogScale)

Last updated: 2026-04-16 Research depth: deep

References (9)

Testing Methodology

Validate this detection against 5 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

Test 1Tasklist Verbose Process Enumeration
Expected signal: Sysmon Event ID 1: Process Create with Image=tasklist.exe, CommandLine='tasklist /v /fo csv'. Security Event ID 4688 (if command line auditing enabled). Sysmon Event ID 11: File Create for %TEMP%\proc_list.csv. Parent process will be cmd.exe or the shell running the test.
Test 2WMIC Process Discovery with Executable Path
Expected signal: Sysmon Event ID 1: Process Create with Image=wmic.exe, CommandLine containing 'process get' and 'ExecutablePath'. WMI-Activity/Operational Event ID 5857/5861 for WMI query execution. Sysmon Event ID 11: File Create for %TEMP%\wmic_proc.csv.
Test 3PowerShell Process Enumeration via Get-Process
Expected signal: Sysmon Event ID 1: Process Create with Image=powershell.exe, CommandLine containing 'Get-Process'. PowerShell ScriptBlock Log Event ID 4104 with full script content. Sysmon Event ID 11: File Create for the CSV output.
Test 4Process Discovery via WMI CIM Instance (PowerShell)
Expected signal: Sysmon Event ID 1: Process Create with Image=powershell.exe, CommandLine containing 'Get-CimInstance Win32_Process'. PowerShell ScriptBlock Log Event ID 4104 showing the full query including security product name filter. WMI-Activity/Operational logs for CIM query execution.
Test 5Linux Process Enumeration via ps with Full Detail
Expected signal: Auditd execve records (if configured with EXECVE audit rules): syscall=execve with argv containing 'ps', 'aux'. Linux syslog/auth.log may capture activity if PAM logging is enabled. On macOS, Unified Log entries with process=ps. Parent process will be the shell (bash/sh/zsh) used to run the test.

Response Playbook

Triage

Identify the initiating process — what spawned the process discovery command? Office applications (WINWORD.EXE, EXCEL.EXE), browser processes, or scripting engines (wscript.exe, mshta.exe) as parents are high-priority indicators of post-exploitation activity
Examine the command line for verbose or targeted flags — 'tasklist /v', 'tasklist /svc', 'wmic process get Name,ExecutablePath,CommandLine,ProcessId' or enumerating specific security products (e.g., querying for av.exe, defender, sentinel) suggests adversary profiling rather than routine admin activity
Check the user account context — is this a standard user, domain admin, or service account? Standard users on endpoints running wmic process queries are unusual; verify whether this account would typically run such commands
Review the timeline: was this process discovery preceded by initial access indicators (phishing open, macro execution, script host activation) within the last 1-4 hours? Correlate with DeviceLogonEvents and DeviceFileEvents for the same host
Look for discovery chaining — adversaries rarely stop at process enumeration. Check if the same process/user also ran whoami, ipconfig/ifconfig, net user, net localgroup administrators, systeminfo, or nltest within the same session window (±15 minutes)
Check for security tool enumeration — search the command output or command line arguments for references to EDR/AV process names (MsMpEng.exe, CSFalconService.exe, SentinelAgent.exe, CarbonBlack). This indicates the adversary is fingerprinting defensive tools
On Linux: if ps was invoked from a web server process (apache2, nginx, httpd, php-fpm, tomcat), treat as critical and initiate IR — this pattern is consistent with web shell post-exploitation

Containment

If process discovery was spawned by a known-malicious parent (Office macro, web shell, exploit payload): immediately isolate the endpoint using EDR network isolation or emergency VLAN change to prevent C2 communication and lateral movement
If the enumeration was performed by a compromised user account: disable the account in Active Directory, revoke active sessions and tokens (including OAuth/SAML), and force password reset for the account and any service accounts accessible from the same host
If security tool enumeration is confirmed (adversary queried for AV/EDR process names): escalate immediately — the adversary is profiling defenses and a targeted kill or bypass attempt is likely imminent; engage IR team and consider additional endpoint isolation
Preserve volatile forensic state before taking containment actions: capture running process list, active network connections (netstat -ano), and memory image if possible from an isolated snapshot or via EDR
Block any external IPs observed in concurrent network connections from the same endpoint or user session at perimeter firewall and DNS

Evidence Collection

Process Creation Events — Sysmon Event ID 1 or Security Event ID 4688 (requires 'Audit Process Creation' policy with command line auditing enabled via GPO: Computer Configuration > Windows Settings > Security Settings > Advanced Audit Policy > Detailed Tracking)
PowerShell ScriptBlock Logging — Event ID 4104 from Microsoft-Windows-PowerShell/Operational; captures full deobfuscated Get-Process and WMI query content including any filtering or output parsing logic
WMI Activity Logs — Microsoft-Windows-WMI-Activity/Operational Event ID 5861 for WMI process queries; includes the caller process PID and query text
Security Event ID 4688 from the Windows Security log — process creation with command line if Audit Process Creation is enabled (required for non-Sysmon environments)
EDR process tree snapshot — retrieve the full parent-child chain from the EDR console to identify all processes involved in the attack chain, not just the discovery command itself
Prefetch files — C:\Windows\Prefetch\TASKLIST.EXE-*.pf, WMIC.EXE-*.pf — execution timestamps and counts help establish frequency and timeline
Linux: bash/sh history files (~/.bash_history, /home/*/.bash_history, /root/.bash_history), auditd logs for execve syscalls if auditd is configured with process execution rules
Linux /proc filesystem contents at time of enumeration: /proc/*/cmdline, /proc/*/status — capture these if a web shell or implant was used to read /proc directly rather than spawning ps

Escalation Criteria

! Process discovery spawned by a scripting engine (wscript.exe, cscript.exe, mshta.exe), Office application, or a non-administrative user on a standard endpoint — this pattern is consistent with malware post-exploitation
! Adversary explicitly queried for or filtered results to identify security tool processes (AV/EDR/XDR names) — defensive fingerprinting precedes tool kill or bypass, indicating an advanced and deliberate threat actor
! Process discovery is one of 3+ discovery techniques (T1033, T1016, T1069, T1082, T1007) executed within a 30-minute window on the same host — discovery chaining at scale is a strong IR trigger
! Process discovery observed on multiple endpoints within a short time window (possible automated lateral movement or worm-like propagation) — query DeviceProcessEvents for the same pattern across all devices
! Discovery executed by a service account or machine identity (e.g., SYSTEM, NT AUTHORITY\NETWORK SERVICE) from an unexpected process — may indicate credential theft and service account compromise

Investigation Guide

Forensic Artifacts

> Windows Prefetch: C:\Windows\Prefetch\TASKLIST.EXE-*.pf — execution count and timestamps; each run increments the counter, allowing estimation of enumeration frequency
> Windows Prefetch: C:\Windows\Prefetch\WMIC.EXE-*.pf — wmic.exe execution history
> Registry: HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\RunMRU — if discovery commands were run interactively via the Run dialog
> Event Log: Microsoft-Windows-WMI-Activity/Operational (Event ID 5857, 5858, 5861) — WMI process query activity with calling process PID
> Event Log: Microsoft-Windows-PowerShell/Operational (Event ID 4103, 4104) — Get-Process and WMI cmdlet execution with full script block content
> Event Log: Security (Event ID 4688) — process creation with command line (requires audit policy); correlate PPID with parent process to build execution chain
> Sysmon Event ID 1 logs — full command line, hash, parent process image path, and process GUID enabling full chain reconstruction
> Linux: /var/log/audit/audit.log — auditd execve records for ps, cat /proc, and related commands if EXECVE rules are configured
> Linux: ~/.bash_history and /root/.bash_history — command history with timestamps if HISTTIMEFORMAT is set
> macOS: Unified Log (log show --predicate 'process == "ps"') — process execution with parent PID in macOS Unified Logging System
> Memory artifacts: if CreateToolhelp32Snapshot or NtQuerySystemInformation were called directly from a malicious process, these API calls appear in memory forensics and ETW traces (Microsoft-Windows-Kernel-Process provider)

Tuning Guidance

Process discovery generates significant noise in enterprise environments due to legitimate administrative activity. The primary tuning strategy is allowlisting by parent process: establish a baseline of which parent processes legitimately spawn tasklist.exe or wmic process queries in your environment (SCCM/ConfigMgr, monitoring agents, installer frameworks) and filter those combinations. For PowerShell Get-Process, focus on unusual initiating processes rather than suppressing by command pattern alone. Consider raising severity thresholds by requiring co-occurrence with other discovery techniques — solo process enumeration by an admin is common; three discovery techniques in 20 minutes is not. For wmic.exe, filter on the specific query patterns: 'wmic process get Name' from a monitoring agent is different from 'wmic process get Name,ExecutablePath,CommandLine' which provides attacker-useful detail. On Linux, tune by the parent of ps: if a web server process (apache2, nginx, php-fpm) spawns ps, alert immediately regardless of arguments. On Windows servers, process discovery by service accounts tied to known monitoring platforms should be excluded; however, do not create broad exclusions by account — use account+parent+hostname combinations. Enable Security Event 4688 command line auditing if not already present, as it provides a second source independent of Sysmon for coverage validation.

Hunting Queries

Hunt for hosts and accounts performing repeated process discovery over 7 days. A high execution count from the same user/host combination may indicate persistent implant activity, automated reconnaissance scripts, or an attacker who has maintained access and periodically re-enumerates the environment. Legitimate admin use is typically infrequent and targeted.

Hunting — KQL

kql

DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("tasklist.exe", "wmic.exe")
    or (FileName in~ ("powershell.exe", "pwsh.exe") and ProcessCommandLine has_any ("Get-Process", "Get-WmiObject", "Get-CimInstance"))
| summarize
    DiscoveryCount = count(),
    Commands = make_set(ProcessCommandLine, 10),
    Parents = make_set(InitiatingProcessFileName, 5),
    FirstSeen = min(Timestamp),
    LastSeen = max(Timestamp)
  by DeviceName, AccountName
| where DiscoveryCount >= 5
| extend DaysActive = datetime_diff('day', LastSeen, FirstSeen)
| sort by DiscoveryCount desc

Hunting — SPL

spl

index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
  (Image="*\\tasklist.exe" OR Image="*\\wmic.exe"
   OR ((Image="*\\powershell.exe" OR Image="*\\pwsh.exe") AND (CommandLine="*Get-Process*" OR CommandLine="*Win32_Process*")))
| stats
    count as DiscoveryCount,
    values(CommandLine) as Commands,
    values(ParentImage) as Parents,
    earliest(_time) as FirstSeen,
    latest(_time) as LastSeen
  by host, User
| where DiscoveryCount >= 5
| eval ActiveDays=round((LastSeen - FirstSeen) / 86400, 1)
| sort - DiscoveryCount

Hunt for discovery chaining: multiple different discovery tools executed by the same account on the same host within a 20-minute window. Adversaries typically run several discovery techniques in rapid succession during the initial post-exploitation recon phase. Three or more distinct discovery tools within 20 minutes is a strong behavioral indicator of active intrusion versus routine administration.

Hunting — KQL

kql

let DiscoveryWindow = 20min;
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("tasklist.exe", "net.exe", "whoami.exe", "ipconfig.exe", "hostname.exe", "systeminfo.exe", "nltest.exe", "wmic.exe")
    or (FileName in~ ("powershell.exe", "pwsh.exe") and ProcessCommandLine has_any ("Get-Process", "Get-LocalUser", "Get-LocalGroup", "ipconfig", "Get-NetAdapter", "Get-WmiObject", "Get-CimInstance"))
| summarize
    TechniquesUsed = dcount(FileName),
    CommandsRun = make_set(ProcessCommandLine, 15),
    ToolsSeen = make_set(FileName, 10)
  by DeviceName, AccountName, bin(Timestamp, DiscoveryWindow)
| where TechniquesUsed >= 3
| sort by TechniquesUsed desc, Timestamp desc

Hunting — SPL

spl

index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
  (Image="*\\tasklist.exe" OR Image="*\\whoami.exe" OR Image="*\\ipconfig.exe"
   OR Image="*\\hostname.exe" OR Image="*\\systeminfo.exe" OR Image="*\\nltest.exe"
   OR Image="*\\wmic.exe" OR Image="*\\net.exe"
   OR ((Image="*\\powershell.exe" OR Image="*\\pwsh.exe") AND (CommandLine="*Get-Process*" OR CommandLine="*Get-LocalUser*" OR CommandLine="*Get-NetAdapter*")))
| bin _time span=20m
| stats
    dc(Image) as TechniquesUsed,
    values(Image) as ToolsSeen,
    values(CommandLine) as CommandsRun
  by _time, host, User
| where TechniquesUsed >= 3
| sort - TechniquesUsed

Hunt for process discovery explicitly targeting security product process names. Adversaries enumerate processes specifically looking for AV/EDR agents (Defender, CrowdStrike, SentinelOne, Carbon Black, Cylance, Tanium) before attempting to kill, blind, or bypass them. This targeted enumeration is a direct precursor to T1562.001 (Impair Defenses) and represents high-fidelity attacker behavior with minimal legitimate use cases.

Hunting — KQL

kql

DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName =~ "wmic.exe"
| where ProcessCommandLine has_any (
    "MsMpEng", "SentinelAgent", "CSFalconService", "CarbonBlack",
    "cb.exe", "bdagent", "kavfs", "klnagent", "cylancesvc",
    "taniumclient", "xagt", "qualysagent", "nessus",
    "antivirus", "defender", "endpoint", "security"
  )
  or (FileName in~ ("powershell.exe", "pwsh.exe")
    and ProcessCommandLine has_any (
      "MsMpEng", "SentinelAgent", "CSFalconService", "CarbonBlack",
      "bdagent", "cylancesvc", "taniumclient", "xagt"
    ))
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
| sort by Timestamp desc

Hunting — SPL

spl

index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
  (Image="*\\wmic.exe" OR Image="*\\tasklist.exe" OR Image="*\\powershell.exe" OR Image="*\\pwsh.exe")
  (CommandLine="*MsMpEng*" OR CommandLine="*SentinelAgent*" OR CommandLine="*CSFalconService*"
   OR CommandLine="*CarbonBlack*" OR CommandLine="*cylancesvc*" OR CommandLine="*bdagent*"
   OR CommandLine="*taniumclient*" OR CommandLine="*xagt*" OR CommandLine="*qualysagent*"
   OR CommandLine="*antivirus*" OR CommandLine="*defender*")
| table _time, host, User, Image, CommandLine, ParentImage, ParentCommandLine
| sort - _time

Atomic Red Team Tests

Test 1 Tasklist Verbose Process Enumeration

windows

Executes tasklist.exe with the /v (verbose) and /fo csv flags to enumerate all running processes with full detail including window titles, memory usage, and session IDs. This matches the technique used by the Turla group's Epic malware ('tasklist /v') and Zebrocy. The /fo csv output format makes the results easy to parse and exfiltrate programmatically.

Command

powershell

tasklist /v /fo csv > %TEMP%\proc_list.csv

Cleanup

powershell

del %TEMP%\proc_list.csv

Expected Telemetry

Sysmon Event ID 1: Process Create with Image=tasklist.exe, CommandLine='tasklist /v /fo csv'. Security Event ID 4688 (if command line auditing enabled). Sysmon Event ID 11: File Create for %TEMP%\proc_list.csv. Parent process will be cmd.exe or the shell running the test.

Expected Detection

KQL: IsTasklistExec=true, HasVerboseFlag=true. SPL: IsTasklist=1, VerboseEnum=1, RiskScore >= 2. The /v flag triggers the VerboseEnum indicator in both queries.

Test 2 WMIC Process Discovery with Executable Path

windows

Uses wmic.exe to query Win32_Process and retrieve the Name, ProcessId, ExecutablePath, and CommandLine for all running processes. This is the exact technique used by Zebrocy ('wmic process get Capture, ExecutablePath') and Volt Typhoon. Retrieving ExecutablePath and CommandLine provides attackers with full details needed to identify security tools and select injection targets.

Command

powershell

wmic process get Name,ProcessId,ExecutablePath,CommandLine /format:csv > %TEMP%\wmic_proc.csv

Cleanup

powershell

del %TEMP%\wmic_proc.csv

Expected Telemetry

Sysmon Event ID 1: Process Create with Image=wmic.exe, CommandLine containing 'process get' and 'ExecutablePath'. WMI-Activity/Operational Event ID 5857/5861 for WMI query execution. Sysmon Event ID 11: File Create for %TEMP%\wmic_proc.csv.

Expected Detection

KQL: IsWmicDiscovery=true, HasVerboseFlag=true. SPL: IsWmicProcess=1, VerboseEnum=1, RiskScore >= 2. Both WmicProcessPatterns ('process get') and VerboseFlag ('executablepath') match.

Test 3 PowerShell Process Enumeration via Get-Process

windows

Uses PowerShell's Get-Process cmdlet to enumerate all running processes and output to a CSV file. This simulates the reconnaissance behavior seen in numerous RAT families and post-exploitation frameworks. The Select-Object expansion to include Path and CPU mimics attacker enumeration of full process details.

Command

powershell

powershell.exe -NoProfile -Command "Get-Process | Select-Object Name,Id,Path,CPU,Description | Export-Csv -Path $env:TEMP\ps_proc.csv -NoTypeInformation"

Cleanup

powershell

Remove-Item $env:TEMP\ps_proc.csv -ErrorAction SilentlyContinue

Expected Telemetry

Sysmon Event ID 1: Process Create with Image=powershell.exe, CommandLine containing 'Get-Process'. PowerShell ScriptBlock Log Event ID 4104 with full script content. Sysmon Event ID 11: File Create for the CSV output.

Expected Detection

KQL: IsPowerShellDiscovery=true. SPL: IsPSGetProcess=1, RiskScore >= 1. The 'Get-Process' pattern matches in both detection queries.

Test 4 Process Discovery via WMI CIM Instance (PowerShell)

windows

Uses PowerShell Get-CimInstance (the modern replacement for Get-WmiObject) to query the Win32_Process class, filtering for processes with names matching common security tool patterns. This simulates an adversary scripting targeted security tool discovery before attempting to kill or blind defenses.

Command

powershell

powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object Name,ProcessId,ExecutablePath,CommandLine | Where-Object {$_.Name -match 'defender|sentinel|falcon|carbon|cylance|tanium'} | Format-List"

Expected Telemetry

Sysmon Event ID 1: Process Create with Image=powershell.exe, CommandLine containing 'Get-CimInstance Win32_Process'. PowerShell ScriptBlock Log Event ID 4104 showing the full query including security product name filter. WMI-Activity/Operational logs for CIM query execution.

Expected Detection

KQL: IsPowerShellDiscovery=true. SPL: IsPSGetProcess=1. Additionally matches the security tool hunting query targeting SentinelAgent, CSFalconService, CarbonBlack patterns in the command line.

Test 5 Linux Process Enumeration via ps with Full Detail

linux

Executes ps with aux flags on Linux/macOS to enumerate all running processes with user, CPU, memory, and full command line arguments. This is the standard post-exploitation reconnaissance step on Unix-like systems as documented in LoudMiner and FruitFly malware behavior. The output is piped to grep to simulate adversaries filtering for specific targets.

Command

bash

ps aux --sort=-%mem | head -50 > /tmp/proc_enum.txt && ps -ef | grep -E '(apache|nginx|docker|containerd|java|python|node)' >> /tmp/proc_enum.txt

Cleanup

bash

rm -f /tmp/proc_enum.txt

Expected Telemetry

Auditd execve records (if configured with EXECVE audit rules): syscall=execve with argv containing 'ps', 'aux'. Linux syslog/auth.log may capture activity if PAM logging is enabled. On macOS, Unified Log entries with process=ps. Parent process will be the shell (bash/sh/zsh) used to run the test.

Expected Detection

Matches the SPL query extension for Linux syslog if auditd is forwarding execve events with sourcetype=linux_secure or auditd. The parent-child relationship (shell spawning ps) is the primary signal; elevated suspicion if parent is a web server process.

What is T1057 Process Discovery?

MITRE ATT&CK

Data Sources

Required Tables

False Positives

Data Sources

Required Sourcetypes

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Sigma rule & cross-platform mapping

Platform-specific guides for T1057

Testing Methodology

Response Playbook

Triage

Containment

Evidence Collection

Escalation Criteria

Investigation Guide

Forensic Artifacts

Tuning Guidance

Hunting Queries

Atomic Red Team Tests

Command

Cleanup

Expected Telemetry

Expected Detection

Command

Cleanup

Expected Telemetry

Expected Detection

Command

Cleanup

Expected Telemetry

Expected Detection

Command

Expected Telemetry

Expected Detection

Command

Cleanup

Expected Telemetry

Expected Detection

Related Detections

Tactic Hub

Related Techniques

Same Tactic: Discovery

Popular Detections

Get new detections in your inbox