T1057 — Process Discovery

Tactic: Discovery · Platforms: ESXi, Linux, macOS, Network Devices, Windows

Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Administrator or otherwise elevated access may provide better process details.…

Sigma detection rules (5)

T1057 Process Discovery

title: T1057 Process Discovery
id: b2868025-47e7-4920-b71d-5232f276aefe
description: 'Detection of adversarial process-discovery behavior via tasklist.exe or PowerShell Get-Process. Corrected logsource category from process_access to process_creation — Image and CommandLine are process-creation fields, so the original category/field pairing did not exist. Tune using: ParentProcessName, CommandLinePattern, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1057
author: Shahrukh Khan
date: 2026-04-07
license: MIT
tags:
  - attack.discovery
  - attack.t1057

logsource:
  category: process_creation
  product: windows
  service: sysmon

detection:
  selection_tasklist:
    Image|endswith: '\tasklist.exe'
  selection_ps:
    CommandLine|contains: 'Get-Process'
  condition: 1 of selection_*

falsepositives:
  - Extremely common benign process-discovery activity.

level: informational

T1057 Process Discovery

title: T1057 Process Discovery
id: c7c2d1b2-9ded-4cd7-918b-9696c22f9ab6
description: 'Detection of Adversarial Process Discovery Behavior. Added coverage for direct /proc filesystem enumeration (find/ls targeting /proc with a numeric-PID pattern), which the technique description explicitly calls out and the prior version entirely omitted; also incorporated auid (the previously-unused UserContext tuning field) into the actual condition rather than leaving it only mentioned in the description, scoping alerts toward non-interactive/automated discovery. (Retargeted to the process_creation auditd telemetry that actually captures this techniques behavior; see logsource below.) Tune using: AccessedPath, UserContext.'
references:
  - https://attack.mitre.org/techniques/T1057
author: Shahrukh Khan
date: 2026-06-15
license: MIT
tags:
  - attack.discovery
  - attack.t1057

logsource:
  category: process_creation
  product: linux

detection:
  selection_tools:
    type: EXECVE
    a0|endswith:
      - '/ps'
      - '/top'
      - '/htop'
      - '/pgrep'
  selection_proc_enum:
    type: EXECVE
    a0|endswith:
      - '/find'
      - '/ls'
    a1|contains: '/proc'
  selection_noninteractive:
    auid: '4294967295'

  condition: (selection_tools or selection_proc_enum) and selection_noninteractive

falsepositives:
  - Extremely common administrative and interactive shell usage; scoping to non-interactive sessions (auid unset) reduces this to service-account/cron/script-triggered discovery, but legitimate monitoring agents and health-check scripts also run non-interactively and will still match.

level: informational

T1057 Process Discovery

title: T1057 Process Discovery
id: b23a0145-ba26-4900-9aa0-25f006840f96
description: 'Detection of Adversarial Process Discovery Behavior. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: ParentApp.'
references:
  - https://attack.mitre.org/techniques/T1057
author: Shahrukh Khan
date: 2026-01-12
license: MIT
tags:
  - attack.discovery
  - attack.t1057

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|endswith:
      - '/ps'
      - '/top'
  selection_launchctl:
    Image|endswith: '/launchctl'
    CommandLine|contains: 'list'
  condition: 1 of selection*

falsepositives:
  - Routine system monitoring or troubleshooting activity by users and administrators.

level: informational

T1057 Process Discovery

title: T1057 Process Discovery
id: d1cec684-50a2-4cf2-a743-9182483e0d7f
description: 'Detection of Adversarial Process Discovery Behavior. (Data Component: Command Execution; baseline tier: fallback.) Tune using: Username, CommandString.'
references:
  - https://attack.mitre.org/techniques/T1057
author: Shahrukh Khan
date: 2026-02-15
license: MIT
tags:
  - attack.discovery
  - attack.t1057

logsource:
  category: process_creation
  product: linux
  service: auditd

detection:
  selection_ps:
    type: EXECVE
    a0|endswith: '/ps'
    a1|contains:
      - 'aux'
      - '-ef'
  selection_top:
    type: EXECVE
    a0|endswith:
      - '/top'
      - '/htop'
  selection_pgrep:
    type: EXECVE
    a0|endswith: '/pgrep'

  condition: 1 of selection_*

falsepositives:
  - Extremely common administrative and monitoring activity; ps, top, and pgrep are run constantly by legitimate operators and health-check scripts.

level: informational

T1057 Process Discovery

title: T1057 Process Discovery
id: fdf69a7a-d2ef-4eff-ad04-1a2a5efcf2d1
description: 'Detection of Adversarial Process Discovery Behavior. (Retargeted to the process_creation ESXi telemetry that actually captures this techniques behavior; see logsource below.) Tune using: User.'
references:
  - https://attack.mitre.org/techniques/T1057
author: Shahrukh Khan
date: 2026-02-19
license: MIT
tags:
  - attack.discovery
  - attack.t1057

logsource:
  category: process_creation
  product: esxi
  service: shell

detection:
  selection:
    CommandLine|contains:
      - 'esxcli system process list'
      - 'ps -c'
      - 'ps -T'

  condition: selection

falsepositives:
  - Routine troubleshooting of hung processes and hostd health checks by administrators and support engineers also invoke these commands.

level: informational

Explore