Clankerusecase
MITRE ATT&CK detection coverage
 ← Back to main site
Home/ MITRE Matrix/ Discovery/ T1057

T1057Process Discovery

T1057 — Process Discovery is a MITRE ATT&CK technique in the Discovery tactic. Clankerusecase tracks 3 detection use cases covering it and 6 threat-intel articles citing it.

Discovery
View on the matrix → Filter Detection Library MITRE official spec ↗
3Use cases
6Articles
0Sub-techniques
1Tactic

Use cases covering this technique (3)

Windows Process Commandline Discovery ESCU actions · hunting P [LLM] NightLedger recon: access to C:\Windows\debug\NetSetup.log by non-system process Bespoke actions · hunting DSPDDCS [LLM] AppVShNotify.exe spawning child processes (NightLedger command dispatcher execution) Bespoke exploit · alerting DSΣPDDCS

Articles citing this technique (6)

crit Nimbus Manticore Deploys NightLedger and Turns Victim Systems Into Covert Relays art-49
crit Mirage Kitten targets Middle East and Africa region with new malware art-53
crit HelloNet campaign: new malicious modules launched through the ViPNet update system art-152
crit ESET takes part in Operation Endgame to disrupt Amadey and Stealc art-301
crit FrostyNeighbor: Fresh mischief and digital shenanigans art-435
crit PlushDaemon compromises network devices for adversary-in-the-middle attacks art-773