Meta tags:

Headings (most frequently used words):

process, discovery, procedure, examples, mitigations, detection, strategy, references,

Text of the page (most frequently used words):
retrieved (380), the (332), processes (252), running (188), and (172), can (141), #process (119), has (115), 2018 (107), 2021 (104), 2020 (97), list (96), may (91), april (77), february (75), 2022 (74), 2024 (71), march (71), june (67), november (67), january (65), malware (62), for (61), 2025 (57), threat (56), enumerate (56), tasklist (54), ransomware (54), 2019 (52), new (52), july (52), august (52), september (51), with (49), used (48), 2017 (47), december (45), 2016 (43), system (42), october (40), team (37), group (35), information (35), all (33), 2023 (33), command (33), 2026 (32), analysis (32), attacks (31), victim (31), compromised (30), targets (29), operation (29), research (29), apt (28), campaign (28), using (27), ability (27), security (26), backdoor (25), machine (25), host (25), from (24), exe (24), identify (24), use (22), targeted (22), global (21), check (21), obtain (21), rat (20), targeting (20), attack (19), discovery (19), 2015 (18), intelligence (18), collect (18), 2014 (17), about (17), through (17), uses (16), actors (16), espionage (16), cyber (16), against (16), windows (16), name (16), trojan (15), specific (15), that (14), target (14), also (14), current (14), actor (13), part (13), get (13), eset (12), remote (12), its (12), tools (12), active (12), gather (12), during (12), variant (11), panda (11), kaspersky (11), unit (11), chinese (11), government (11), organizations (11), north (11), korean (11), into (11), systems (11), associated (11), infected (11), att (10), techniques (10), south (10), microsoft (10), turla (10), monitor (10), including (10), lists (10), report (9), falcone (9), macos (9), lab (9), api (9), cisa (9), fireeye (9), under (9), symantec (9), pid (9), collects (9), software (8), data (8), detection (8), secure (8), winnti (8), phishing (8), access (8), sector (8), malicious (8), cloud (8), deep (8), lazarus (8), lockbit (8), execution (8), such (8), hosts (8), discover (8), determine (8), enterprise (7), campaigns (7), their (7), asia (7), tool (7), activity (7), esxi (7), module (7), services (7), mar (7), linux (7), mercer (7), sherstobitoff (7), network (7), fin7 (7), stealer (7), lee (7), korea (7), grunzweig (7), medusa (7), run (7), based (7), via (7), parent (7), createtoolhelp32snapshot (7), checks (7), search (7), are (6), ics (6), groups (6), zero (6), exploitation (6), more (6), compromise (6), critical (6), custom (6), post (6), cve (6), east (6), latest (6), earth (6), great (6), continues (6), labs (6), qilin (6), muddywater (6), powershell (6), one (6), version (6), years (6), carbon (6), open (6), evolution (6), cobalt (6), adversaries (6), explorer (6), function (6), enumerated (6), ensure (6), searched (6), applications (6), mobile (5), none (5), ivanti (5), connect (5), day (5), leverages (5), sofacy (5), 2013 (5), behind (5), defense (5), ukraine (5), chen (5), back (5), environments (5), trickbot (5), exploit (5), teamtnt (5), supply (5), chain (5), lunghi (5), spear (5), loader (5), multiple (5), victims (5), modules (5), your (5), financial (5), hunter (5), cert (5), faou (5), cybereason (5), rotajakiro (5), middle (5), malhotra (5), files (5), powersploit (5), response (5), black (5), devices (5), latrodectus (5), this (5), havoc (5), web (5), blackenergy (5), embargo (5), servers (5), capability (5), strike (5), bumblebee (5), bisonal (5), babuk (5), found (5), detects (5), listing (5), proc (5), commands (5), path (5), loaded (5), currently (5), details (5), mitre (4), components (4), novetta (4), suspected (4), zebrocy (4), framework (4), returns (4), infrastructure (4), cyberespionage (4), russian (4), related (4), perform (4), operations (4), tropic (4), trooper (4), patrick (4), github (4), investigation (4), sophisticated (4), sysupdate (4), synack (4), technique (4), crowdstrike (4), solarwinds (4), sunburst (4), shell (4), dive (4), stage (4), gold (4), abusing (4), server (4), banking (4), royal (4), long (4), rokrat (4), rascagneres (4), arsenal (4), technical (4), incident (4), center (4), ratankba (4), raspberry (4), robin (4), darkhotel (4), agenda (4), encryption (4), point (4), multi (4), usage (4), 2012 (4), plugx (4), play (4), over (4), toolkit (4), mustang (4), discovered (4), hacking (4), eastern (4), toddycat (4), clearsky (4), miller (4), akira (4), mundo (4), platform (4), utilities (4), lodeinfo (4), depth (4), analyzing (4), botnet (4), konni (4), attackers (4), invisimole (4), well (4), hydraq (4), dragon (4), been (4), finfisher (4), epic (4), dtrack (4), darkgate (4), carberp (4), bazar (4), azorult (4), kimsuky (4), device (4), common (4), identifies (4), names (4), contains (4), gathered (4), monitored (4), have (4), toneshell (4), cmd (4), obtains (4), collected (4), environment (4), pubload (4), retrieve (4), find (4), obtained (4), will (4), terminate (4), grep (4), other (4), funnydream (4), domains (3), resources (3), cti (3), strategies (3), mitigations (3), defenses (3), sub (3), tactics (3), adds (3), zxshell (3), mclellan (3), vpn (3), zeus (3), sednit (3), schwarz (3), xagentosx (3), woody (3), than (3), game (3), naikon (3), blackberry (3), waterbear (3), state (3), sponsored (3), volt (3), typhoon (3), volgmer (3), vermin (3), salem (3), valak (3), ursnif (3), fbi (3), hunting (3), snake (3), uboatrat (3), tscookie (3), usbferry (3), secureworks (3), karagany (3), energy (3), china (3), exploiting (3), vulnerability (3), preta (3), persistence (3), look (3), read (3), teampcp (3), you (3), update (3), tajmahal (3), taintedscribe (3), taidoor (3), tiger (3), systembc (3), sykipot (3), likely (3), gets (3), sunspot (3), storm (3), 0501 (3), scott (3), dhs (3), sorefang (3), national (3), slothfulmedia (3), skidmap (3), cryptocurrency (3), mining (3), payload (3), silenttrinity (3), sidewinder (3), shrinklocker (3), prior (3), adversary (3), shadowpad (3), management (3), sardonic (3), ryuk (3), rtm (3), rocke (3), evolves (3), remcos (3), cybersecurity (3), redpenguin (3), trend (3), micro (3), ransomhub (3), ramsay (3), rise (3), qakbot (3), iranian (3), powerstats (3), powerduke (3), think (3), tanks (3), poseidon (3), apt37 (3), poetrat (3), python (3), following (3), plaintee (3), families (3), pillowmint (3), pasam (3), updates (3), singh (3), paklog (3), apt10 (3), include (3), outsteel (3), wocao (3), hidden (3), honeybee (3), cuckoobees (3), stealthy (3), oilrig (3), helminth (3), oceansalt (3), code (3), obliquerat (3), nkabuse (3), njrat (3), dedola (3), léveillé (3), foreign (3), netwire (3), vrabie (3), military (3), navrat (3), worldwide (3), exploits (3), mosquito (3), osborn (3), moonwind (3), mispadu (3), mirrorface (3), metamorfo (3), executable (3), maze (3), magic (3), hound (3), hiding (3), cherepanov (3), machete (3), lucifer (3), loudminer (3), cross (3), lookback (3), linfo (3), lightspy (3), like (3), lamehug (3), apt28 (3), bear (3), russia (3), komplex (3), alert (3), kinsing (3), killdisk (3), keymarble (3), alive (3), ke3chang (3), kazuar (3), kasidet (3), advanced (3), ixeshe (3), ironnetinjector (3), two (3), tricks (3), inception (3), inc (3), imminent (3), 2010 (3), higaisa (3), hiddenface (3), sombrat (3), behavior (3), gravityrat (3), grandoreiro (3), how (3), sdbbot (3), get2 (3), gelsemium (3), gamaredon (3), fysbis (3), mac (3), frameworkpos (3), foggyweb (3), flagpro (3), machines (3), evilbunny (3), uroburos (3), frankenstein (3), elise (3), ekans (3), lusca (3), dustysky (3), duqu (3), donut (3), doki (3), diavol (3), temp (3), derusbi (3), darktortilla (3), darkcomet (3), dacls (3), cyclops (3), blink (3), cuckoo (3), cuba (3), transparent (3), tribe (3), conti (3), comnie (3), service (3), coathanger (3), clop (3), cardinal (3), carbanak (3), out (3), cannon (3), caddywiper (3), bundlore (3), features (3), brickstorm (3), backdoors (3), bbsrat (3), bankshot (3), badhatch (3), bad (3), rabbit (3), babyshark (3), avoslocker (3), avaddon (3), astaroth (3), antivirus (3), ashtag (3), checking (3), apt38 (3), apt3 (3), apt1 (3), appleseed (3), wiper (3), andariel (3), show (3), correlates (3), user (3), scripts (3), created (3), snapshot (3), capture (3), calling (3), tasks (3), unc3886 (3), capable (3), 231 (3), enumerates (3), directory (3), privileges (3), whether (3), executing (3), reconnaissance (3), performs (3), 127 (3), creates (3), which (3), calls (3), installed (3), mgbot (3), utilized (3), hard (3), coded (3), kill (3), query (3), invisibleferret (3), not (3), goopy (3), empire (3), ids (3), string (3), c0015 (3), corporation (2), reference (2), analytics (2), assets (2), matrices (2), core (2), objects (2), allievi (2), spotlight (2), cutting (2), edge (2), accenture (2), land (2), modular (2), robert (2), feature (2), just (2), baumgartner (2), fake (2), news (2), persistent (2), counter (2), off (2), lancaster (2), ron (2), craft (2), vmware (2), guest (2), hayashi (2), tomonaga (2), ray (2), updated (2), connections (2), hong (2), kong (2), boutin (2), disrupt (2), 22457 (2), john (2), wolfram (2), michael (2), matt (2), lin (2), josh (2), murchie (2), actively (2), morales (2), nick (2), dai (2), legitimate (2), wardle (2), uncovered (2), alibaba (2), oliveira (2), tracking (2), mccarthy (2), aqua (2), trivy (2), ecosystem (2), project (2), daniel (2), iron (2), doppelgänging (2), ivanov (2), 2011 (2), another (2), agencies (2), implant (2), evasive (2), attacker (2), crew (2), fly (2), big (2), radar (2), hybrid (2), keep (2), calm (2), austin (2), tyler (2), case (2), ar25 (2), fivehands (2), observations (2), 365 (2), defender (2), second (2), cash (2), dark (2), mission (2), bitlocker (2), lock (2), pirpi (2), politically (2), motivated (2), stealing (2), ta505 (2), fin8 (2), goes (2), authority (2), asian (2), manual (2), live (2), golang (2), zhang (2), turns (2), delving (2), watering (2), evolved (2), script (2), governments (2), uncovering (2), methods (2), exposed (2), deploys (2), aka (2), evasion (2), sentinelone (2), resurfaces (2), dumont (2), recent (2), adair (2), widespread (2), reaper (2), bermejo (2), blacktech (2), tartare (2), document (2), downloader (2), maritime (2), uncovers (2), nocturnus (2), saudi (2), deliver (2), source (2), hacker (2), multiplatform (2), affecting (2), media (2), delivers (2), diplomats (2), dissecting (2), sunny (2), blog (2), europe (2), japanese (2), iran (2), avast (2), metador (2), appendix (2), increase (2), ehrlich (2), dead (2), only (2), institutions (2), diplomatic (2), high (2), engineering (2), down (2), understanding (2), pentest (2), ethical (2), client (2), steal (2), blockbuster (2), proofpoint (2), spider (2), known (2), google (2), routers (2), drive (2), observed (2), platforms (2), bennett (2), entities (2), route (2), loading (2), story (2), spyware (2), since (2), job (2), park (2), zafra (2), old (2), tau (2), return (2), linked (2), dupuy (2), shuckworm (2), virtual (2), deploy (2), industry (2), solving (2), some (2), mysteries (2), asec (2), rust (2), zykov (2), industries (2), strategic (2), llc (2), dutch (2), lebanese (2), configuration (2), hook (2), still (2), when (2), infects (2), plugins (2), abuse (2), tactic (2), mandiant (2), locker (2), pulse (2), compromising (2), identified (2), monitors (2), cli (2), unusual (2), unauthorized (2), roles (2), enumeration (2), sessions (2), interactive (2), esxcli (2), top (2), context (2), analytic (2), description (2), zxxz (2), zox (2), zipline (2), output (2), yty (2), getprocesslist (2), aux (2), install (2), winmm (2), 261 (2), winerack (2), windshift (2), warzonerat (2), 350 (2), see (2), upstyle (2), named (2), 267 (2), 114 (2), enumerating (2), conducted (2), searching (2), home (2), trailblaze (2), checked (2), matches (2), expected (2), triggering (2), exception (2), handler (2), 238 (2), thiefquest (2), containing (2), locate (2), actions (2), execute (2), syscon (2), svcready (2), extracted (2), line (2), arguments (2), msbuild (2), hashed (2), hardcoded (2), logged (2), strongpity (2), streamex (2), gathers (2), stealth (2), falcon (2), spawnchimera (2), 144 (2), 250 (2), sodamaster (2), socksbot (2), socgholish (2), language (2), shotput (2), shimratreporter (2), seasalt (2), 249 (2), saint (2), bot (2), sagerunex (2), called (2), getcurrentprocess (2), permissions (2), advisory (2), sandbox (2), roguerobin (2), detect (2), rising (2), sun (2), remsec (2), rcsession (2), 233 (2), rainyday (2), purecrypter (2), pupy (2), leveraged (2), was (2), 149 (2), 191 (2), proxysvc (2), powruner (2), powerstallion (2), given (2), powershower (2), pooraim (2), plead (2), iterate (2), injection (2), pipemon (2), every (2), collecting (2), pcshare (2), pandora (2), p8rat (2), orz (2), blocklisted (2), ninja (2), nightdoor (2), specified (2), nightclub (2), send (2), listings (2), neteagle (2), nebulae (2), 205 (2), muddyviper (2), sent (2), 101 (2), molerats (2), mobileorder (2), includes (2), watchdog (2), meteor (2), 211 (2), metamain (2), megazord (2), terminates (2), 215 (2), different (2), markirat (2), mafalda (2), osaminer (2), macma (2), component (2), browsers (2), lunarweb (2), notes (2), lizar (2), kwampirs (2), follow (2), kopiluwak (2), jrat (2), jpin (2), jhuhugit (2), javali (2), ipsec (2), helper (2), industroyer2 (2), 126 (2), ikitten (2), hotcroissant (2), hiupan (2), heyoka (2), hexane (2), hellokitty (2), halfbaked (2), hafnium (2), gh0st (2), geminiduke (2), fruitfly (2), 113 (2), final1stspy (2), felixroot (2), fatduke (2), local (2), emotet (2), elmer (2), dusttrap (2), examine (2), debugger (2), present (2), dratzarus (2), down_new (2), utility (2), crimson (2), sql (2), clambling (2), chimneysweep (2), chimera (2), chches (2), charmpower (2), caterpillar (2), webshell (2), functionality (2), brute (2), ratel (2), brave (2), prince (2), bonadan (2), bluelight (2), blackcoffee (2), biscuit (2), backspace (2), oldrea (2), avenger (2), asyncrat (2), aria (2), body (2), apt5 (2), apostle (2), agent (2), tesla (2), advstoreshell (2), poland (2), t1057 (2), could (2), ckcon (2), person (2), tickets (2), faq (2), registered, trademarks, cookie, preferences, website, changelog, privacy, policy, terms, contact, reset, filters, raghuprasad, bitter, bangladesh, opening, smn, axiom, ebach, results, snakemackerel, journey, what, going, sopko, donot, xagent, malwarebytes, rich, spotted, wild, golovkin, msnmm, earliest, bahamut, hack, hire, masters, apps, hooking, evade, harakhavik, warzone, enemy, lines, prc, maintain, bronze, silhouette, living, yagi, cortes, quasar, meets, eye, sioting, bkdr_ursnif, caragay, multifaceted, brief, midnighteclipse, 3400, alexander, marvi, brad, slaybaugh, rufus, brown, privileged, hypervisors, navigates, air, gapped, taiwanese, fossil, fuel, provider, poison, ivy, tudorica, maximciuc, vatamanu, bruteforces, rdp, select, telecommunication, takes, sila, ozeren, hacioglu, unc5221, weaponizing, edie, jacob, thompson, nexus, nathaniel, mixes, sidestep, osx, evilquest, infection, darin, smith, aws, fiser, activities, closer, focused, haughom, kics, action, strikes, again, temporarily, everything, need, know, ongoing, continued, remediation, usg, 10288834, dod, 10292089, reappears, gallagher, operators, shelf, tor, mccabe, fractured, statue, agency, bettencourt, finds, blasco, sample, federal, schlapfer, ready, build, highly, promethium, extends, reach, strongpity3, cylance, variants, continue, expanding, marczak, railton, don, enable, macros, uae, dissidents, larsen, ashley, pearson, lukasz, lamparski, joseph, pisano, ryan, hall, shawn, billy, wong, lateral, movement, studies, 25993211, resurge, 087a, 10296782, ar21, 126a, costaricto, outsourced, early, bird, catches, wormhole, stellarparticle, mstic, cdoc, solorigate, activation, teardrop, raindrop, halo, breach, untangling, patchwork, prelude, force, 10303705, remillano, urbanec, rootkit, capabilities, hide, salvati, hegel, perspective, splunk, teoderick, contreras, wartell, 3113, days, yonathan, klijnsma, mofang, popular, hit, institute, profiling, budaca, agile, symntec, billbug, countries, hanel, lucrative, guide, soc, teams, rumble, alex, turing, hui, wang, secret, pantazopoulos, introducing, darkhydrus, anomali, family, written, sharpshooter, projectsauron, juniper, networks, apt27, large, scale, holes, enterprises, lei, cryptocurrencies, reveals, controller, schläpfer, now, spreading, christopher, telecom, stopransomware, antiy, infiltration, isolation, takeda, cases, byovd, health, coordination, halcyon, boasts, enhanced, magdy, customizes, morrow, blind, eagle, justice, nicolas, verdier, sardiwal, apt34, 11882, horejsi, powershellmafia, atlas, election, ngos, boutique, specializing, overlooked, covid, lures, azerbaijan, public, private, sectors, computer, luxembourg, trail, ash, rancor, ddkong, trustwave, spiderlabs, monkey, thief, mullaney, honda, sudeep, corklog, splatcloak, layered, ecipekac, a41apt, payloads, saintbot, axel, pierre, leviathan, spearphishes, dantzig, schamper, shining, light, mcafee, humanitarian, aid, crambus, arabian, canada, hijacked, websites, gert, unveiling, nkn, protocol, pascual, autoit, compiled, worm, removable, fileless, bladabindi, logs, ahn, facundo, muñoz, marc, etienne, monlam, festival, tibetans, moustachedbouncer, belarus, maniath, kadam, hollowing, traces, summit, decoy, vickie, hamzeloofard, wave, avira, expands, bitten, trochilus, rats, thai, scarlet, mimic, minority, activists, advertisement, discounted, unhappy, meal, organisations, daggerfly, telecoms, company, africa, indra, hackers, erlich, abuser, hides, sentinellabs, zemah, assessment, howling, scorpius, vlad, pasca, anthony, galiette, doel, santos, turning, stone, ferocious, kitten, covert, surveillance, mystery, unattributed, telcos, isps, universities, phil, stokes, fade, adventures, reversing, applescripts, hole, dazzlespy, got, sharper, venezuelan, jurčacko, moon, doors, lunar, landing, missions, hsu, cryptojacking, ddos, vulnerabilities, infect, snakes, riverbank, malik, cracked, vst, raggi, united, states, impersonating, licensing, boards, itochu, endless, struggle, insights, ishimaru, walter, unpicking, anti, mitigation, removal, indicators, zone, threats, cybercriminal, disguises, seals, masquerades, zhou, stuart, ashenbrenner, alden, schmidt, saini, hossein, ghostsecret, seeks, banks, bitcoin, users, loaders, installers, uninstallers, unraveling, thread, sony, batista, coming, stepanic, bousseaden, spring, cleaning, potential, replacement, icedid, cymru, bytes, ice, simonovich, cato, ctrl, first, llm, powered, links, fancy, gtig, tracker, advances, orangeworm, healthcare, lotus, roasting, firewall, hawley, galaxy, opportunity, targetting, karmi, dani, creus, halfpop, singer, container, den, iuzvyk, tim, peck, trusted, blogs, profile, gilbert, sison, rheniel, ramos, jay, yaneza, alfredo, hits, latin, american, 10135536, smallridge, apt15, strong, royalcli, royaldns, villeneuve, moran, haq, geers, ministries, affairs, levene, yadav, office, dropping, dridex, bingham, frutas, builder, door, platinum, southeast, approaching, tetrade, brazilian, sancho, reichel, hromcova, cherpanov, hromcová, surprisingly, equipped, undercover, employers, seeking, employment, hallmarks, seongsu, pyongyang, payroll, workers, west, kapellmann, raymond, leong, chris, sistrunk, ken, proska, corey, hildebrandt, keith, lunden, nathan, brubaker, industroyer, learns, proxies, lelli, knight, lenart, ted, breitenbacher, unmasking, joey, aoqin, newly, quietly, spying, kayal, lyceum, reborn, counterintelligence, moore, unc2447, wan, sharepoint, graph, fud, shivtarkar, jain, across, cyberspace, ungur, carr, lnk, eoin, defending, exchange, year, india, engorged, dahan, kitty, demonstrating, hustle, quickly, 5119, leak, distributes, dukes, primitive, doctor, kremez, fin6, sale, internals, ramin, nafisi, nobelium, leads, hada, flori, researcher, tale, defeating, traps, complex, nokki, almost, ties, knot, dogcall, automotive, greyenergy, successor, ghost, marschalek, instrumented, lua, uroboros, adamitis, cobble, together, pieces, monstrous, schroeder, warner, nelson, powershellempire, vol, cyble, revolution, steps, jan, holman, tomas, zvara, rock, winters, eps, awakens, dragonfish, form, asean, defence, ministers, meeting, associates, singleton, kiefer, trends, learning, industrial, production, dragos, gaza, cybergang, group1, sneakypastes, mike, stokkel, apt41, arisen, dust, w32, precursor, next, stuxnet, hod, gavriel, nuclear, power, plant, konstantin, hello, dream, thewover, fishbein, kajiloti, watch, containers, infecting, docker, neeamni, rubinfeld, wizard, periscope, fidelis, turbo, featuring, bit, alperovitch, thought, mcgraw, basta, drops, zbot, adi, zeligson, rotem, kerner, enter, kujawa, dirty, mabutas, shows, ncsc, kohler, lopez, behaves, between, infostealer, roccio, baisini, begins, education, huss, baskin, penetration, testers, mavis, art, science, detecting, mivd, general, aivd, ministry, netherlands, fortigate, drbcontrol, jenkins, roadsweep, conducts, disruptive, albanian, jansen, menupass, academics, apt35, log4j, distribute, cedar, leveraging, paper, peering, trusteer, fraud, prevention, hood, vengerik, dear, joohn, wheels, double, header, isaacwiper, dfir, continuing, sushko, virus, bypassing, chronicles, bee, connection, kamble, rapidly, assuming, central, position, crime, merriman, trouerbach, isn, optimus, prime, but, transforming, harbison, renals, brutal, red, teaming, being, abused, 338a, saavedra, widens, olympics, gains, permanent, presence, porcher, side, forsshe, landscape, openssh, meltzer, inkysquid, browser, sshbeardoor, ukrainian, electric, garnaeva, be2, router, profiles, quedagh, convergence, crimeware, plain, sight, expose, obfuscation, cactuspete, digital, roaming, team9, development, cycles, cobra, turkish, improved, mamedov, sinitsyn, apt30, mechanics, dragonfly, suppliers, centero, seth, maoloa, teslacrypt, cobralocker, sogeti, improves, spreads, alongside, yan, wine, bottle, findmyname, fallout, kit, hasherezade, enters, scene, asks, partners, endtrade, tick, attacking, classified, yuste, pastrana, decryption, jornet, snip3, passwords, personal, hamas

Text of the page (random words):
to identify running processes on the victim s machine 305 s0692 silenttrinity silenttrinity can enumerate processes including properties to determine if they have the common language runtime clr loaded 306 s0468 skidmap skidmap has monitored critical processes to ensure resiliency 307 s0533 slothfulmedia slothfulmedia has enumerated processes by id name or privileges 308 s1124 socgholish socgholish can list processes on targeted hosts 309 s0273 socksbot socksbot can list all running processes 310 s0627 sodamaster sodamaster can search a list of running processes 250 c0024 solarwinds compromise during the solarwinds compromise apt29 used multiple command line utilities to enumerate running processes 311 312 313 s0615 sombrat sombrat can use the getprocesslist command to enumerate processes on a compromised host 314 144 315 s0516 sorefang sorefang can enumerate processes on a victim machine through use of tasklist 316 s9024 spawnchimera spawnchimera has searched for running processes to include web or dsmdm 317 318 g0038 stealth falcon stealth falcon malware gathers a list of running processes 319 g1053 storm 0501 storm 0501 has discovered running processes through tasklist exe 320 s0142 streamex streamex has the ability to enumerate processes 321 s0491 strongpity strongpity can determine if a user is logged in by checking to see if explorer exe is running 322 s0559 sunburst sunburst collected a list of process names that were hashed using a fnv 1a xor algorithm to check against similarly hashed hardcoded blocklists 323 s0562 sunspot sunspot monitored running processes for instances of msbuild exe by hashing the name of each running process and comparing it to the corresponding value 0x53d525 it also extracted command line arguments and individual arguments from the running msbuild exe process to identify the directory path of the orion software visual studio solution 324 s1064 svcready svcready can collect a list of running processes from an infected host 325 s0018 sykipot sykipot may gather a list of running processes by running tasklist v 326 s0242 synack synack enumerates all running processes 327 328 s0464 syscon syscon has the ability to use tasklist to list running processes 329 s9001 systembc systembc has the ability to enumerate running processes 330 s0663 sysupdate sysupdate can collect information about running processes 331 s0011 taidoor taidoor can use getcurrentprocessid for process discovery 332 s0586 taintedscribe taintedscribe can execute processlist for process discovery 333 s0467 tajmahal tajmahal has the ability to identify running processes and associated plugins on an infected host 334 s0057 tasklist tasklist can be used to discover processes running on a system 335 s9041 teampcp cloud stealer teampcp cloud stealer can locate github actions runner processes 336 337 338 339 g0139 teamtnt teamtnt has searched for rival malware and removes it if found 340 teamtnt has also searched for running processes containing the strings aliyun or liyun to identify machines running alibaba cloud security tools 341 s0595 thiefquest thiefquest obtains a list of running processes using the function kill_unwanted 342 g1022 toddycat toddycat has run cmd c start b tasklist to enumerate processes 238 s1239 toneshell toneshell has checked the process name and process path to ensure it matches the expected one prior to triggering a custom exception handler 231 toneshell has also searched for running antivirus processes to include eset s antivirus associated executables ekrn exe and egui exe 343 s9012 trailblaze trailblaze has conducted process discovery by searching for specific named processes such as home bin web 344 345 s0266 trickbot trickbot uses module networkdll for process list discovery 346 347 s0094 trojan karagany trojan karagany can use tasklist to collect a list of running tasks 33 348 g0081 tropic trooper tropic trooper is capable of enumerating the running processes on the system using pslist 349 350 s0436 tscookie tscookie has the ability to list processes on the infected host 351 g0010 turla turla surveys a system upon check in to discover running processes using the tasklist v command 114 turla rpc backdoors have also enumerated processes associated with specific open ports or named pipes 267 s0333 uboatrat uboatrat can list running processes on the system 352 g1048 unc3886 unc3886 has run scripts to list all running processes on a guest vm from an esxi host 353 s1164 upstyle upstyle has the ability to read proc self cmdline to see if it is running as a monitored process 354 s0022 uroburos uroburos can use its process list command to enumerate processes on compromised hosts 355 s0386 ursnif ursnif has gathered information about running processes 356 357 s0452 usbferry usbferry can use tasklist to gather information about the process running on the infected system 350 s0476 valak valak has the ability to enumerate running processes on a compromised host 358 s0257 vermin vermin can get a list of the processes and running tasks on the system 359 s0180 volgmer volgmer can gather a list of processes 360 g1017 volt typhoon volt typhoon has enumerated running processes on targeted systems including through the use of tasklist 361 362 363 s0670 warzonerat warzonerat can obtain a list of processes on a compromised host 364 s0579 waterbear waterbear can identify the process for a specific security product 365 g0112 windshift windshift has used malware to enumerate active processes 366 s0219 winerack winerack can enumerate processes 261 s0059 winmm winmm sets a wh_cbt windows hook to collect information on process creation 367 s0141 winnti for windows winnti for windows can check if the explorer exe process is responsible for calling its install function 368 g0044 winnti group winnti group looked for a specific process running on infected servers 369 s1065 woody rat woody rat can call ntquerysystemprocessinformation with systemprocessinformation to enumerate all running processes including associated information such as pid parent pid image name and owner 370 s0161 xagentosx xagentosx contains the getprocesslist function to run ps aux to get running processes 371 s0248 yty yty gets an output of running processes using the tasklist command 372 s0251 zebrocy zebrocy uses the tasklist and wmic process get capture executablepath commands to gather the processes running on the system 59 373 60 374 375 s0330 zeus panda zeus panda checks for running processes on the victim s machine 376 s1114 zipline zipline can identify running processes and their names 377 s0672 zox zox has the ability to list processes 378 s0412 zxshell zxshell has a command ps to obtain a listing of processes on the system 379 s1013 zxxz zxxz has created a snapshot of running processes using createtoolhelp32snapshot 380 mitigations this type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features detection strategy id name analytic id analytic description det0034 detection of adversarial process discovery behavior an0095 identifies adversary behavior that launches commands or invokes apis to enumerate active processes e g tasklist exe get process or createtoolhelp32snapshot detects execution combined with parent process lineage network session context or remote origin an0096 detects execution of common process enumeration utilities e g ps top htop or access to proc with suspicious ancestry correlates command usage with interactive shell context and user role an0097 monitors execution of ps top or launchctl with unusual parent processes or from terminal scripts also detects applescript based process listing or system_profiler spapplicationsdatatype misuse an0098 detects process enumeration using esxcli system process list or ps on esxi shell or via unauthorized ssh sessions correlates with interactive sessions and abnormal user roles an0099 monitors cli based execution of show process or equivalent on routers switches correlates unusual device access unauthorized roles or config mode changes references zhongyuan hau aaron ren jie yow and yoav mazor 2025 january 21 esxi ransomware attacks stealthy persistence through retrieved march 27 2025 michael dawson 2021 august 30 hypervisor jackpotting part 2 ecrime actors increase targeting of esxi servers with ransomware retrieved march 26 2025 us cert 2018 april 20 alert ta18 106a russian state sponsored cyber actors targeting network infrastructure devices retrieved october 19 2020 cisco 2022 august 16 show processes retrieved july 13 2022 cert polska 2026 january 30 energy sector incident report 29 december retrieved april 22 2026 crowdstrike global intelligence team 2014 june 9 crowdstrike intelligence report putter panda retrieved january 22 2016 eset 2016 october en route with sednit part 2 observing the comings and goings retrieved november 21 2016 zhang x 2017 june 28 in depth analysis of a new variant of net malware agenttesla retrieved november 5 2018 max kersten alexandre mundo 2023 november 29 akira ransomware retrieved april 4 2024 park s 2021 june 15 andariel evolves to target south korea with ransomware retrieved september 29 2021 amitai ben shushan ehrlich 2021 may from wiper to ransomware the evolution of agrius retrieved may 21 2024 jazi h 2021 june 1 kimsuky apt continues to target south korean government using appleseed backdoor retrieved june 10 2021 mandiant n d apt1 exposing one of china s cyber espionage units retrieved july 18 2016 unit 42 2017 december 15 unit 42 playbook viewer retrieved december 20 2017 chen x scott m caselden d 2014 april 26 new zero day exploit targeting internet explorer versions 9 through 11 identified in targeted attacks retrieved january 14 2016 yates m 2017 june 18 apt3 uncovered the code evolution of pirpi retrieved september 28 2017 mercer w rascagneres p 2018 january 16 korea in the crosshairs retrieved may 21 2018 fireeye 2018 october 03 apt38 un usual suspects retrieved november 17 2024 perez d et al 2021 may 27 re checking your pulse updates on chinese apt actors compromising pulse secure vpn devices retrieved february 5 2024 checkpoint 2020 may 7 naikon apt cyber espionage reloaded retrieved may 26 2020 unit 42 2025 december 11 hamas affiliated ashen lepus targets middle eastern diplomatic entities with new ashtag malware suite retrieved april 20 2026 salem e 2019 february 13 astaroth malware uses legitimate os and antivirus processes to steal passwords and personal data retrieved april 17 2019 jornet a 2021 december 23 snip3 an investigation into malware retrieved september 19 2023 yuste j pastrana s 2021 february 9 avaddon ransomware an in depth analysis and decryption of infected systems retrieved august 19 2021 chen j et al 2019 november operation endtrade tick s multi stage backdoors for attacking industries and stealing classified data retrieved june 9 2020 hasherezade 2021 july 23 avoslocker enters the ransomware scene asks for partners retrieved january 11 2023 yan t et al 2018 november 21 new wine in old bottle new azorult variant found in findmyname campaign using fallout exploit kit retrieved november 29 2018 proofpoint 2018 july 30 new version of azorult stealer improves loading features spreads alongside ransomware in new campaign retrieved november 29 2018 sogeti 2021 march babuk ransomware retrieved august 11 2021 mundo a et al 2021 february technical analysis of babuk ransomware retrieved august 11 2021 centero r et al 2021 february 5 new in ransomware seth locker babuk locker maoloa teslacrypt and cobralocker retrieved august 11 2021 unit 42 2019 february 22 new babyshark malware targets u s national security think tanks retrieved october 7 2019 symantec security response 2014 june 30 dragonfly cyberespionage attacks against energy suppliers retrieved april 8 2016 fireeye labs 2015 april apt30 and the mechanics of a long running cyber espionage operation retrieved november 17 2024 mamedov o sinitsyn f ivanov a 2017 october 24 bad rabbit ransomware retrieved january 28 2021 vrabie v et al 2021 march 10 fin8 returns with improved badhatch toolkit retrieved september 8 2021 sherstobitoff r 2018 march 08 hidden cobra targets turkish financial sector with new bankshot implant retrieved may 18 2018 cybereason nocturnus 2020 july 16 a bazar of tricks following team9 s development cycles retrieved november 18 2020 lee b grunzweig j 2015 december 22 bbsrat attacks targeting russian organizations linked to roaming tiger retrieved august 19 2016 mandiant n d appendix c digital the malware arsenal retrieved july 18 2016 hayashi k ray v 2018 july 31 bisonal malware used in attacks against russia and south korea retrieved august 7 2018 zykov k 2020 august 13 cactuspete apt group s updated bisonal backdoor retrieved may 5 2021 mercer w et al 2020 march 5 bisonal 10 years of play retrieved january 26 2022 fireeye labs fireeye threat intelligence 2015 may 14 hiding in plain sight fireeye and microsoft expose obfuscation tactic retrieved november 17 2024 f secure labs 2014 blackenergy quedagh the convergence of crimeware and apt attacks retrieved march 24 2016 baumgartner k and garnaeva m 2014 november 3 be2 custom plugins router abuse and target profiles retrieved march 24 2016 cherepanov a 2016 january 3 blackenergy by the sshbeardoor attacks against ukrainian news media and electric industry retrieved june 10 2020 cash d grunzweig j meltzer m adair s lancaster t 2021 august 17 north korean apt inkysquid infects victims using browser exploits retrieved september 30 2021 dumont r m léveillé m porcher h 2018 december 1 the dark side of the forsshe a landscape of openssh backdoors retrieved july 16 2020 sherstobitoff r saavedra morales j 2018 february 02 gold dragon widens olympics malware attacks gains permanent presence on victims systems retrieved june 6 2018 dhs cisa 2026 february 11 ar25 338a brickstorm backdoor retrieved april 16 2026 harbison m and renals p 2022 july 5 when pentest tools go brutal red teaming tool being abused by malicious actors retrieved february 1 2023 merriman k and trouerbach p 2022 april 28 this isn t optimus prime s bumblebee but it s still transforming retrieved august 22 2022 kamble v 2022 june 28 bumblebee new loader rapidly assuming central position in cyber crime ecosystem retrieved august 24 2022 salem a 2022 april 27 the chronicles of bumblebee the hook the bee and the trickbot connection retrieved september 2 2022 sushko o 2019 april 17 macos bundlore mac virus bypassing macos security features retrieved june 30 2020 dfir report 2021 november 29 continuing the bazar ransomware story retrieved september 29 2022 threat intelligence team 2022 march 18 double header isaacwiper and caddywiper retrieved april 11 2022 falcone r lee b 2018 november 20 sofacy continues global attacks and wheels out new cannon trojan retrieved november 26 2018 lee b falcone r 2018 december 12 dear joohn the sofacy group s global campaign retrieved april 19 2019 bennett j ...