AN0095
Analytic 0095
Windows
Identifies adversary behavior that launches commands or invokes APIs to enumerate active processes (e.g., tasklist.exe, Get-Process, or CreateToolhelp32Snapshot). Detects execution combined with parent process lineage, network session context, or remote origin.
WinEventLog:Security
EventCode=4688
WinEventLog:Sysmon
EventCode=10
[ParentProcessName]
Used to scope suspicious discovery from non-interactive or non-standard parent processes like Office macros, WMI, or script engines
[CommandLinePattern]
Adversaries may obfuscate or vary process discovery commands (e.g., aliases, PowerShell variants)
[TimeWindow]
Helps detect bursty discovery behavior within a short timeframe
AN0096
Analytic 0096
Linux
Detects execution of common process enumeration utilities (e.g., ps, top, htop) or access to /proc with suspicious ancestry. Correlates command usage with interactive shell context and user role.
auditd:SYSCALL
execve
auditd:SYSCALL
openat
linux:osquery
Process State
[AccessedPath]
Filter based on suspicious /proc directory enumeration or high-volume ls/readlink usage
[UserContext]
Helps tune for root vs. low-priv users during interactive vs. scripted activity
AN0097
Analytic 0097
macOS
Monitors execution of ps, top, or launchctl with unusual parent processes or from terminal scripts. Also detects AppleScript-based process listing or `system_profiler SPApplicationsDataType` misuse.
macos:unifiedlog
process launch
macos:osquery
Process Context
[ParentApp]
Tunable to detect discovery from non-UI tools or script-based execution (osascript, zsh, cron)
AN0098
Analytic 0098
ESXi
Detects process enumeration using `esxcli system process list` or `ps` on ESXi shell or via unauthorized SSH sessions. Correlates with interactive sessions and abnormal user roles.
esxi:shell
interactive shell
esxi:auth
user session
[User]
Admins are expected to run these commands—flag if non-admin or unknown users do
AN0099
Analytic 0099
Network Devices
Monitors CLI-based execution of `show process` or equivalent on routers/switches. Correlates unusual device access, unauthorized roles, or config mode changes.
networkdevice:cli
CLI command
networkdevice:syslog
Admin activity
[Username]
Tunable based on authorized operators for network infrastructure
[CommandString]
Pattern match or regex scope for discovery commands