Suspicious PowerShell Enumeration of Running Processes

Cortex Toolbox Ingest Calculator Platform Changes

Detectors ▾

All detectors Statistics ATT&CK matrix

Analytics Alerts BIOCs Correlation Rules

Content ▾

Packs Integrations MCP Servers Threat Feeds Reputation Commands

Automation

Playbooks Scripts Jobs Automation Rules Lists

Case and Issue Setup

Incident Fields Layouts Layout Rules

Threat Intelligence

Indicator Types Indicator Fields Reputation Commands Threat Feeds

Data Ingestion

Parsing Rules Modeling Rules XDRC Templates

Dashboards & Reports

XSIAM Dashboards XSIAM Reports

Docs ▾

Documentation XDM Explorer Cortex Versions

Settings ▾

Sign in

Analytics BIOC Informational

✕

Suspicious PowerShell Enumeration of Running Processes

Attackers often enumerate running processes to find and disable security tools.

Module:: Platform Analytics
Data source:: XDR Agent

ATT&CK tactics: Discovery (TA0007)

ATT&CK techniques: Process Discovery (T1057)

Attacker's goals:

Understand the type of host according to the processes running on it; find and disable security tools.

Investigative actions:

Verify whether the command that was executed is benign or normal for the host and/or user performing it (for example, it may be an IT script).

Test period:: N/A (single event)
Deduplication:: 1 Day