Process enumeration via tasklist, WMI process class or PowerShell cmdlets

Siemphony@siemphonylowT1057unverified

Matches AN0095's "commands or invokes APIs to enumerate active processes (e.g., tasklist.exe, Get-Process, or CreateToolhelp32Snapshot)" using the three command-line forms that surface it: tasklist.exe itself, the PowerShell Get-Process/Get-CimInstance/Get-WmiObject process cmdlets, and wmic.exe invoked against the process class. CreateToolhelp32Snapshot is a bare API call with no command-line footprint and is not covered here. Sysmon EventID 10 (process_access) was considered and dropped: tasklist.exe opens a handle to every enumerated process, but that produces one process_access event per running process rather than one event for the enumeration itself, and the field this technique would key on (GrantedAccess) is already the anchor for unrelated credential-access rules, so reusing it here would be noise, not signal. MITRE's ParentProcessName and TimeWindow knobs (non-interactive callers, bursty discovery) have no equivalent in a single event and are not encoded. The brief's only process_creation source for this analytic is Security EventID 4688, which needs the Audit Process Creation subcategory enabled and the separate Include command line in process creation events policy — neither is on by default, and without the second policy specifically the CommandLine-based arms of this rule match nothing at all. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0034, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where (FolderPath endswith "\\tasklist.exe" or (ProcessCommandLine contains "Get-Process" or ProcessCommandLine contains "Get-CimInstance -ClassName Win32_Process" or ProcessCommandLine contains "Get-CimInstance Win32_Process" or ProcessCommandLine contains "Get-WmiObject -Class Win32_Process" or ProcessCommandLine contains "Get-WmiObject Win32_Process") or (FolderPath endswith "\\wmic.exe" and ProcessCommandLine contains "process"))

Splunk · SPL

Run this as a search.

index=* (Image="*\\tasklist.exe" OR (CommandLine="*Get-Process*" OR CommandLine="*Get-CimInstance -ClassName Win32_Process*" OR CommandLine="*Get-CimInstance Win32_Process*" OR CommandLine="*Get-WmiObject -Class Win32_Process*" OR CommandLine="*Get-WmiObject Win32_Process*") OR (Image="*\\wmic.exe" AND CommandLine="*process*"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE (TO_LOWER(process.executable) LIKE "*\\\\tasklist.exe" OR (TO_LOWER(process.command_line) LIKE "*get-process*" OR TO_LOWER(process.command_line) LIKE "*get-ciminstance -classname win32_process*" OR TO_LOWER(process.command_line) LIKE "*get-ciminstance win32_process*" OR TO_LOWER(process.command_line) LIKE "*get-wmiobject -class win32_process*" OR TO_LOWER(process.command_line) LIKE "*get-wmiobject win32_process*") OR (TO_LOWER(process.executable) LIKE "*\\\\wmic.exe" AND TO_LOWER(process.command_line) LIKE "*process*"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <!-- 3 rules: the Sigma condition ORs across different fields,       which one rule cannot express. Any one matching is a hit. -->  <rule id="100000" level="5">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)\\tasklist\.exe$</field>    <description>Process enumeration via tasklist, WMI process class or PowerShell cmdlets (1/3)</description>    <mitre>      <id>T1057</id>    </mitre>  </rule>   <rule id="100001" level="5">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="CommandLine" type="pcre2">(?i)(Get-Process|Get-CimInstance -ClassName Win32_Process|Get-CimInstance Win32_Process|Get-WmiObject -Class Win32_Process|Get-WmiObject Win32_Process)</field>    <description>Process enumeration via tasklist, WMI process class or PowerShell cmdlets (2/3)</description>    <mitre>      <id>T1057</id>    </mitre>  </rule>   <rule id="100002" level="5">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)\\wmic\.exe$</field>    <field name="CommandLine" type="pcre2">(?i)process</field>    <description>Process enumeration via tasklist, WMI process class or PowerShell cmdlets (3/3)</description>    <mitre>      <id>T1057</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: low
Category: discovery_recon
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: a665cc17-d3fe-4041-a108-7fc9e00d2377

ATT&CKT1057

T1057Process Discovery

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessondiscovery recon

discovery reconAI draft — unreviewed

01 · What this rule detects

The three command-line-visible ways AN0095 names for enumerating running processes on Windows: tasklist.exe, the PowerShell process cmdlets (Get-Process, Get-CimInstance/Get-WmiObject against Win32_Process), and wmic.exe invoked against the process class. AN0095 also names the raw CreateToolhelp32Snapshot API call, but that has no command-line footprint and is not covered — this rule can only see enumeration that goes through a shell or interpreter.

02 · Telemetry you need

Security EventID 4688 (process_creation), reading Image and CommandLine. Two policies gate this, and they gate different parts of the rule: Audit Process Creation is required for the event to exist at all, and the separate Include command line in process creation events policy is required for CommandLine to be populated. Neither is on by default. Without the second policy, selection_tasklist still fires on Image alone, but selection_ps_cmdlet and the CommandLine half of selection_wmic go dark silently.

03 · How the logic works

The three blocks are OR'd, not AND'd — any one match fires the rule. This is CommandLinePattern, MITRE's knob for this analytic, populated with the author's own list of cmdlet spellings, not MITRE's. Sysmon EventID 10 (process_access) is the brief's other logsource for AN0095, and the rule's description explains why it was dropped rather than authored: tasklist.exe opens a handle to every process it enumerates, so EID 10 yields one event per target process rather than one event per enumeration, and its GrantedAccess field is already the anchor for unrelated credential-access rules in this corpus — reusing it here would add noise, not signal. MITRE's ParentProcessName and TimeWindow knobs have no single-event equivalent and are not encoded. The reviewer flagged the rule's own description as too long for the authoring contract's 2-4 sentence limit — worth knowing as you read it, because the extra sentences are exactly the reasoning above, not padding.

04 · Common false positives

The first false positive is also the dominant one: RMM agents and performance dashboards polling Get-Process, Get-CimInstance Win32_Process or wmic process on a fixed schedule across a whole managed fleet is described as "the loudest and most routine source of matches" on a monitored estate. Helpdesk staff running tasklist interactively to check a service, and installers checking whether an instance is already running, are lower volume but equally benign. The wmic arm has a fourth, structural false positive: it keys on the bare word process, so wmic process where name=... delete or ... call terminate — process management, not discovery — matches identically to wmic process list.

05 · Detection maturity

tier_1: .** UNVERIFIED — derived from MITRE ATT&CK DET0034 and never executed against logs. level: low matches the rule's own top false positive (fleet-wide RMM polling), so the calibration is internally consistent.
tier_2: means running it over history to size the RMM/wmic volume and add ParentProcessName scoping;
tier_3: means adding alias/reflection coverage and MITRE's TimeWindow for bursty enumeration.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Add ParentProcessName scoping to exclude the known RMM/monitoring parent processes — that is where the volume lives, per the rule's own top false positive. The reviewer's evasion note names what the current selectors miss entirely: PowerShell short aliases (gps, gwmi, gcim), .NET reflection via [System.Diagnostics.Process]::GetProcesses(), and any -EncodedCommand/base64-obfuscated invocation all produce zero CommandLine|contains hits. A renamed tasklist.exe also defeats Image|endswith since nothing here checks OriginalFileName or a hash. The reviewer separately notes wmic.exe is deprecated and removed by default from Windows 11 22H2 and Server 2025 onward, so that branch will increasingly never fire on modern fleets. Wazuh refuses this rule outright — it cannot OR across different fields in one rule — so this detection has no Wazuh translation without splitting it into per-field rules.

Declared by the author

Remote monitoring and management (RMM) agents and performance-dashboard tools that poll Get-Process, Get-CimInstance Win32_Process or wmic process on a fixed schedule across the whole managed fleet — on a monitored estate this is the loudest and most routine source of matches.
Helpdesk and support staff running tasklist.exe interactively to confirm whether a specific service or application process is running, a standard first troubleshooting step.
Installers and application launchers that call tasklist or Get-Process to check whether an instance of the target application is already running before proceeding.
The wmic arm also matches process-management commands that are not discovery, such as wmic process where name=... delete or wmic process call terminate, because both share the bare word 'process' with the enumeration form wmic process list.

Noise checkfires on 1 of 30

Fires on 1 of 30 ordinary behaviours the baseline holds for this log type. Each is something a managed estate does on purpose, so each is a false positive an analyst would have to close.

pc-tasklist-monitoring
Process enumeration by a monitoring agent — the same call an attacker makes for discovery.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
0 true · 1 false · 100.0% noise

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1057, evaluated against their process_creation events.

Share this rule

/u/siemphony/a665cc17-d3fe-4041-a108-7fc9e00d2377

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Process enumeration via tasklist, WMI process class or PowerShell cmdlets

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it