TA0007 · DISCOVERY
Process Discovery
Listing running processes, usually to identify security tooling before disabling it.
Detect it with
tasklist and ps output followed quickly by attempts to stop security services.
Why it matters on shift
Process Discovery is one of the concrete ways adversaries achieve discovery. Recognising it in telemetry lets you name the technique in your ticket and pivot to what came before and after.
What to look for next
After discovery, the next tactic is usually Lateral Movement. Search your telemetry for the transition before closing the ticket.
Kill-chain context