T1057 Process Discovery in real malware
ATT&CK technique T1057 Process Discovery appears in 1546 publicly analyzed samples on MalwareAnalyzer by Cyble, 1.3% of the analyzed corpus. Seven-day prevalence is falling (0 recent vs 5 prior). Most associated families: HUILoader, Fugrafa, Emotet, Delf, Lmir.
Tactics: discovery
Prevalence in the corpus
- Samples exhibiting T1057: 1546
- Share of analyzed corpus: 1.3%
- Last 7 days: 0 · prior 7 days: 5 (falling)
Malware families using T1057
Example samples
- node.dll - malicious
- NewHuYue_26.8.4.1_huyue.exe - malicious
- erto3e4rortoergn.exe - malicious
- ProjectManager.exe - suspicious
- bkb.exe - malicious
- client.dll - malicious
- Loader.exe - suspicious
- ZClient.exe - malicious
- YimMenuV2.dll - malicious
- RealSetup_a14070b008b49ef8bc14a2d9736df6e2a9762decc75ef9912a6828fe0ddcf5c4.exe - malicious
- USBDeview.exe - suspicious
- BrowsingHistoryView.exe - malicious
- BrowserDownloadsView.exe - malicious
- LoadedDllsView.exe - suspicious
- LastActivityView.exe - malicious
- Aurora15Connector.exe - malicious
- SCUT.exe - malicious
- ADInsight64.exe - malicious
- Aurora15Connector.exe - malicious
- Aurora15Connector.exe - malicious
- Aurora15Connector.exe - malicious
- FB831A56_lock.exe - malicious
- Aurora15Connector.exe - malicious
- Advanced_IP_Scanner_2.5.4594.1.exe - suspicious
- 9768b7e31324805672cfcba91cf4d6da91494e9899db58f22da9dda6c91931d6.exe - malicious
Canonical technique definition: MITRE ATT&CK T1057 (ATT&CK v19.1, CC BY 4.0).
Frequently asked about T1057
- How common is ATT&CK T1057 (Process Discovery) in real malware?
- ATT&CK technique T1057 Process Discovery appears in 1546 publicly analyzed samples on MalwareAnalyzer by Cyble, 1.3% of the analyzed corpus. Seven-day prevalence is falling (0 recent vs 5 prior). Most associated families: HUILoader, Fugrafa, Emotet, Delf, Lmir.
- Is T1057 becoming more common?
- Prevalence is falling: 0 samples in the last seven days against 5 in the seven days before. This measures submissions to MalwareAnalyzer by Cyble, so it reflects what is being submitted here rather than global attacker behaviour.
- Which malware families use T1057?
- In this corpus T1057 is most associated with HUILoader (135), Fugrafa (95), Emotet (67), Delf (55), Lmir (54). Counts are analyzed samples per family in which the technique was observed.
- What share of analyzed samples use T1057?
- 1.3% of the publicly analyzed corpus (1546 of 119218 samples) exhibits T1057. Technique attribution comes from behavior captured during real sandbox detonation and from static analysis, not from a vendor label.
All ATT&CK techniques in the corpus · Latest analyzed threats