īISCUIT has a command to enumerate running processes and identify their owners. īazar can identity the current process on a compromised host. īankshot identifies processes and collects the process ids. īad Rabbit can enumerate all running processes to compare hashes. īACKSPACE may collect information about running processes. īackdoor.Oldrea collects information about running processes. īabyShark has executed the tasklist command. īabuk has the ability to check running processes on a targeted system. Īzorult can collect a list of running processes by calling CreateToolhelp32Snapshot. Īvenger has the ability to use Tasklist to identify running processes. Īvaddon has collected information about running processes. Īria-body has the ability to enumerate loaded modules for a process.Īstaroth searches for different processes on the system. ĪPT38 leveraged Sysmon to understand the processes, services in the organization. ĪPT37's Freenki malware lists running processes using the Microsoft Windows API. ĪPT3 has a tool that can list out currently running processes.

ĪPT29 has used multiple command-line utilities to enumerate running processes.

Īn APT28 loader Trojan will enumerate the victim's processes searching for explorer.exe if its current process does not have necessary permissions. ĪPT1 gathered a list of running processes on the system using tasklist /v. ĪppleSeed can enumerate the current process on a compromised host. Īndariel has used tasklist to enumerate processes and find a specific string. Īgent Tesla can list the current running processes on the system. ĪDVSTORESHELL can list running processes. 4H RAT has the capability to obtain a listing of running processes (including loaded modules).

Wireshark filters showing apt1 attacks