Windows Suspicious Tasklist.exe Process Discovery via Command-Line

Alerts on Windows executions of tasklist.exe used for running process discovery.

FreeUnreviewedSigmainformationalv1

windows-suspicious-tasklist-exe-process-discovery-via-command-line-63332011

title: Windows Suspicious Tasklist.exe Process Discovery via Command-Line
id: 1afdbf46-1f9e-43e6-9b32-6c2bf2b42ccb
status: test
description: This rule flags process creation events where the command line contains 'tasklist' and the executed binary appears to be tasklist.exe based on image path and OriginalFileName. Adversaries may use tasklist output to quickly enumerate running processes to understand what software is present and potentially tailor subsequent actions. It relies on Windows process creation telemetry, including CommandLine, Image path, and OriginalFileName.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1057/T1057.md#atomic-test-2---process-discovery---tasklist
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/process_creation/proc_creation_win_tasklist_basic_execution.yml
author: frack113, Huntrule Team
date: 2021-12-11
modified: 2022-12-25
tags:
  - attack.discovery
  - attack.t1057
  - detection.threat-hunting
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    - CommandLine|contains: tasklist
    - Image|endswith: \tasklist.exe
    - OriginalFileName: tasklist.exe
  condition: selection
falsepositives:
  - Likely from users, administrator and different internal and third party applications.
level: informational
license: DRL-1.1
related:
  - id: 63332011-f057-496c-ad8d-d2b6afb27f96
    type: derived

What it detects

This rule flags process creation events where the command line contains 'tasklist' and the executed binary appears to be tasklist.exe based on image path and OriginalFileName. Adversaries may use tasklist output to quickly enumerate running processes to understand what software is present and potentially tailor subsequent actions. It relies on Windows process creation telemetry, including CommandLine, Image path, and OriginalFileName.

Known false positives

Likely from users, administrator and different internal and third party applications.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.