sigmainformationalHunting

Suspicious Tasklist Discovery Command

Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network

MITRE ATT&CK

T1057

discovery

Detection Query

selection:
  - CommandLine|contains: tasklist
  - Image|endswith: \tasklist.exe
  - OriginalFileName: tasklist.exe
condition: selection

Author

frack113

Created

2021-12-11

Data Sources

windowsProcess Creation Events

Platforms

windows

References

https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1057/T1057.md#atomic-test-2---process-discovery---tasklist

Tags

attack.discoveryattack.t1057detection.threat-hunting

Raw Content

title: Suspicious Tasklist Discovery Command
id: 63332011-f057-496c-ad8d-d2b6afb27f96
status: test
description: Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1057/T1057.md#atomic-test-2---process-discovery---tasklist
author: frack113
date: 2021-12-11
modified: 2022-12-25
tags:
    - attack.discovery
    - attack.t1057
    - detection.threat-hunting
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        - CommandLine|contains: 'tasklist'
        - Image|endswith: '\tasklist.exe'
        - OriginalFileName: 'tasklist.exe'
    condition: selection
falsepositives:
    - Likely from users, administrator and different internal and third party applications.
level: informational