Adversaries may attempt to get information about running processes on a device. Information obtained could be used to gain an understanding of common software/applications running on devices within a network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Recent Android security enhancements have made it more difficult to obtain a list of running processes. On Android 7 and later, there is no way for an application to obtain the process list without abusing elevated privileges. This is due to the Android kernel utilizing the hidepid mount feature. Prior to Android 7, applications could utilize the ps command or examine the /proc directory on the device.[1]
In iOS, applications have previously been able to use the sysctl command to obtain a list of running processes. This functionality has been removed in later iOS versions.
| ID | Name | Description |
|---|---|---|
| S0440 | Agent Smith |
Agent Smith checks if a targeted application is running in user-space prior to infection.[2] |
| S0422 | Anubis | |
| S1215 | Binary Validator |
Binary Validator has obtained a list of running processes.[4] |
| S1225 | CherryBlos |
CherryBlos has used the Accessibility Service to monitor when a wallet application has launched.[5] |
| S0421 | GolfSpy | |
| S0544 | HenBox | |
| S1185 | LightSpy | |
| C0054 | Operation Triangulation |
During Operation Triangulation, the threat actors have obtained a list of processes.[10] |
| S0411 | Rotexy | |
| S1055 | SharkBot |
SharkBot can use Accessibility Services to detect which process is in the foreground.[12] |
| S1216 | TriangleDB |
TriangleDB has collected a list of running processes.[10] |
| S0489 | WolfRAT |
WolfRAT uses |
| S0311 | YiSpecter |
YiSpecter has collected information about running processes.[14] |
| ID | Mitigation | Description |
|---|---|---|
| M1002 | Attestation |
Attestation can typically detect rooted devices. For MDM-enrolled devices, action can be taken if a device fails an attestation check. |
| M1006 | Use Recent OS Version |
Android 7 and later iOS versions introduced changes that prevent applications from performing Process Discovery without elevated privileges. |
| ID | Name | Analytic ID | Analytic Description |
|---|---|---|---|
| DET0692 | Detection of Process Discovery | AN1804 |
For Android, detect Process Discovery by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate File Access via Application Vetting / Forensic Acquisition [Dynamic filesystem trace or acquired app-container/filesystem artifacts: opendir('/proc/') with recursive listdir by app NOT IN $ProcessDiscoveryAllowList$ on device with android_version < $HidepidVersion$]; Network Connection Creation via Android Enterprise Network Logging / Enterprise VPN [DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata]; Process Metadata via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: running process names read from /proc/ |
| AN1805 |
For iOS, detect Process Discovery by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate Application State via Apple MDM [InstalledApplicationList / ManagedApplicationList]; Host Status via Apple MDM [DeviceInformation / SecurityInfo / ProfileList / restrictions and compliance queries]; Network Traffic Flow via Apple Network Extension / Enterprise VPN [NEFilterFlow / per-app VPN / secure-web-gateway flow metadata]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone. |