T1057 - Process Discovery

MITRE ATT&CK

Threat entity extracted from intelligence sources

Entities›MITRE ATT&CK›T1057 - Process Discovery

Frequency

occurrences

First Seen

February 4, 2026

Last Seen

September 5, 2026

API

Overview

Recent Events

Profile

1 / 2

REC

Recon

No techniques detected

Resource Dev

No techniques detected

Initial Access

T1190 - Exploit Public-Facing ApplicationT1078 - Valid AccountsT1566.001 - Spearphishing AttachmentT1133 - External Remote Services

Execution

T1059.001 - PowerShellT1053 - Scheduled Task/JobT1047 - Windows Management Instrumentation

Persistence

T1543.003 - Windows ServiceT1547.001 - Registry Run Keys / Startup FolderT1574 - Hijack Execution FlowT1136 - Create AccountT1505.003 - Web Shell

Priv Esc

T1055 - Process InjectionT1068 - Exploitation for Privilege Escalation

Defense Evasion

T1036 - MasqueradingT1027 - Obfuscated Files Or InformationT1562.001 - Disable Or Modify ToolsT1112 - Modify RegistryT1070.001 - Clear Windows Event Logs

Cred Access

T1003 - OS Credential DumpingT1110 - Brute Force

Discovery

T1082 - System Information DiscoveryT1083 - File And Directory DiscoveryT1016 - System Network Configuration DiscoveryT1018 - Remote System Discovery

Lateral Mov

T1021 - Remote Services

Collection

T1113 - Screen CaptureT1005 - Data From Local System

T1071 - Application Layer ProtocolT1105 - Ingress Tool TransferT1572 - Protocol TunnelingT1090 - Proxy

Exfil

T1567.002 - Exfiltration to Cloud StorageT1041 - Exfiltration Over C2 Channel

Impact

T1486 - Data Encrypted for ImpactT1485 - Data DestructionT1490 - Inhibit System Recovery

58 techniques detected across 12 tactics

Relationships

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Related Clusters (27)

Critical Exploitation of Sangoma Switchvox Vulnerabilities Underway

Sep 2·11 sources

Mirage Kitten Targets Aviation and FinTech with New Cross-Platform Malware

Sep 1·8 sources

Tortoiseshell Expands Malware Arsenal with New Backdoor and SSH Tunneling Tool

Aug 26·6 sources

Tropic Trooper Expands Tactics with Multi-Stage Attacks on Japanese and Taiwanese Targets

Apr 24·5 sources

QuickFox VPN Supply Chain Attack Delivers FDMTP Backdoor to Windows Users

Aug 6·14 sources

SHEETCREEP Espionage Campaign Uses UAE-India Lure for RAT Deployment

Jun 12·4 sources

Mirage Kitten Malware Targets Middle East and Africa with New Toolset

Jul 30·2 sources

Showboat Malware Targets Telecoms in China-Aligned Cyber Espionage Campaign

May 21·9 sources

FishMonger Expands SprySOCKS Malware to Windows with Kernel-Level Stealth

Jun 16·12 sources

Active Exploitation of N-able N-central Authentication Bypass Vulnerability

Aug 5·12 sources

Italy Extradites Chinese Hacker Xu Zewei to the U.S. for COVID-19 Research Theft

Apr 26·51 sources

Storm-0501 Cybercrime Group Targets Azure with Ransomware Tactics

Aug 17·2 sources

PATCHCORD Malware Targets Afghan Telecom and South Asian Infrastructure

Aug 13·10 sources

UAT-10147 Threat Actor Deploys SPECTRE Backdoor with AI and EDR Bypass Techniques

Aug 24·2 sources

Active Exploitation of Weaver E-cology RCE Vulnerability CVE-2026-22679

May 5·3 sources

Critical Gitea Vulnerability CVE-2026-60004 Actively Exploited

Aug 26·21 sources

Exploitation of PaperCut Vulnerabilities Threatens Educational Institutions

5d ago·6 sources

Mini Shai-Hulud Supply Chain Attack Targets SAP npm Packages

Apr 29·753 sources

Tengu Botnet Utilizes Hardware Watchdog to Evade Detection and Removal

Jul 28·10 sources

Vishing Campaigns Target Organizations via Microsoft Teams and New Operator Console

Jul 29·9 sources

InstallFix Campaign Exploits AI Trust to Deliver Malware via Fake Install Pages

May 5·53 sources

Vidar Infostealer Targets SMBs with Malvertising Campaign

Jul 8·2 sources

Powercat Malware Campaign Targets Gamers with Infostealer Disguised as Cheats

Aug 3·8 sources

OkoBot Malware Targets Cryptocurrency Users to Steal Seed Phrases

Jul 15·20 sources

Ransomware Fuels Surge in Global Cyberattacks

Feb 12·1922 sources

Attackers Exploit Vulnerable Windows Driver to Disable EDR Tools

Feb 5·4 sources

Cortex XDR Live Terminal Vulnerability Enables C2 Exploitation

Feb 25·3 sources

1 / 6

Related Entities

Mirage Kitten Nimbus Manticore Apt36 Earth Lusca FishMonger Smoke Sandstorm Transparent Tribe Unc1549 Aquatic Panda Malware Phishing Data Breach

T1057 - Process Discovery

Overview

Recent Events

Profile

Exploited By

Associated Malware

Tools Used

Related CVEs

Campaigns

Affected Platforms

Regions

Sectors Affected

Relationships

Related Clusters (27)

Critical Exploitation of Sangoma Switchvox Vulnerabilities Underway

Mirage Kitten Targets Aviation and FinTech with New Cross-Platform Malware

Tortoiseshell Expands Malware Arsenal with New Backdoor and SSH Tunneling Tool

Tropic Trooper Expands Tactics with Multi-Stage Attacks on Japanese and Taiwanese Targets

QuickFox VPN Supply Chain Attack Delivers FDMTP Backdoor to Windows Users

SHEETCREEP Espionage Campaign Uses UAE-India Lure for RAT Deployment

Mirage Kitten Malware Targets Middle East and Africa with New Toolset

Showboat Malware Targets Telecoms in China-Aligned Cyber Espionage Campaign

FishMonger Expands SprySOCKS Malware to Windows with Kernel-Level Stealth

Active Exploitation of N-able N-central Authentication Bypass Vulnerability

Italy Extradites Chinese Hacker Xu Zewei to the U.S. for COVID-19 Research Theft

Storm-0501 Cybercrime Group Targets Azure with Ransomware Tactics

PATCHCORD Malware Targets Afghan Telecom and South Asian Infrastructure

UAT-10147 Threat Actor Deploys SPECTRE Backdoor with AI and EDR Bypass Techniques

Active Exploitation of Weaver E-cology RCE Vulnerability CVE-2026-22679

Critical Gitea Vulnerability CVE-2026-60004 Actively Exploited

Exploitation of PaperCut Vulnerabilities Threatens Educational Institutions

Mini Shai-Hulud Supply Chain Attack Targets SAP npm Packages

Tengu Botnet Utilizes Hardware Watchdog to Evade Detection and Removal

Vishing Campaigns Target Organizations via Microsoft Teams and New Operator Console

InstallFix Campaign Exploits AI Trust to Deliver Malware via Fake Install Pages

Vidar Infostealer Targets SMBs with Malvertising Campaign

Powercat Malware Campaign Targets Gamers with Infostealer Disguised as Cheats

OkoBot Malware Targets Cryptocurrency Users to Steal Seed Phrases

Ransomware Fuels Surge in Global Cyberattacks

Attackers Exploit Vulnerable Windows Driver to Disable EDR Tools

Cortex XDR Live Terminal Vulnerability Enables C2 Exploitation

Related Articles (28)

PaperCut Flaws Exploited in Attacks on U.S. and European Schools

Attackers Exploit PaperCut Flaws to Steal Credentials From Schools and Universities

Exploitation of Sangoma Switchvox flaw is underway (CVE-2026-9586)

Iranian Hackers Pose as Recruiters to Deliver Cross

Hackers target Gitea servers with critical code injection flaw

Securelist

UAT-10147 SPECTRE Uses Linux Rootkit and BYOVD

PATCHCORD: New malware cluster targets Afghan telecom and South Asian critical infrastructure

PATCHCORD: New malware cluster targets Afghan telecom and South Asian critical infrastructure

Fortinet Threat Research: QuickFox Supply Chain Attack Used to Deploy FDMTP Implant

Powercat Malware Campaign Fake Game Cheats Deliver Infostealer Targeting Discord Roblox And Crypto Wallets

QuickFox Windows Supply Chain Attack Delivers FDMTP Backdoor via Trojanized Installer

Active exploitation of N-able N-central authentication bypass flaw

CVE-2026-18577: N-able N-central Auth Bypass

Nozomi Networks Labs

New Chaos Ransomware

Mirage Kitten targets Middle East and Africa region with new malware

Kaspersky reveals a new malicious framework targeting cryptocurrency users with the use of ...

New Malicious Campaign Delivers Vidar Infostealer and Monero Crypto Miner

SprySOCKS backdoor expands to Windows with new variants

ESET Research: China-aligned FishMonger updates its arsenal, targets governments in ...

Hackers Use UAE

Introducing Showboat: A new malware family taunts defenses and targets international telecom firms

Redline Stealer Variants Demonstrate A Low Barrier To Entry Threat

Weaver E

Axios NPM Distribution Compromised in Supply Chain Attack

Hackers Exploit Cortex XDR Live Terminal for C2 Communications

They Got In Through SonicWall. Then They Tried to Kill Every Security Tool

Related Entities