Home/ MITRE Matrix/ Discovery/ T1057

T1057Process Discovery

T1057 — Process Discovery is a MITRE ATT&CK technique in the Discovery tactic. Clankerusecase tracks 3 detection use cases covering it and 6 threat-intel articles citing it.

Discovery

View on the matrix → Filter Detection Library MITRE official spec ↗

3Use cases

6Articles

0Sub-techniques

1Tactic

Use cases covering this technique (3)

Windows Process Commandline Discovery ESCU actions · hunting P [LLM] Lazarus MISTPEN DLL side-load chain via trojanized PDF viewer (libmupdf.dll + recon modules) Bespoke install · hunting DSΣPDDCS [LLM] OctLurk victim-fingerprinting recon command burst (chcp 1256 + qwinsta + klist + tasklist) Bespoke actions · hunting DSPDDCS

Articles citing this technique (6)

crit Lazarus Exploits Windows Zero-Day to Gain SYSTEM Access and Deploy Backdoor art-64

crit 128 Seconds to disruption: Microsoft Defender stops ransomware at QNET art-124

crit OctLurk and SilkLurk: newly identified tailored backdoors in cyber-espionage campaign in Central Asia art-169

crit ESET takes part in Operation Endgame to disrupt Amadey and Stealc art-351

crit FrostyNeighbor: Fresh mischief and digital shenanigans art-481

crit PlushDaemon compromises network devices for adversary-in-the-middle attacks art-803