ATT&CK Technique · Discovery
T1057 Process DiscoveryMapped by 14 reports, 0 detection rules and 10 tracked actors on The Hunters Ledger. Technique page on attack.mitre.org.
← All techniques and the coverage heatmap
Reports
Each report maps this technique in its own ATT&CK table, at the confidence the report states. The link opens that table.
Detection rules
No published detection rule on the site covers this technique yet.
Tracked actors
Designations whose reports map this technique.
- UTA-2026-001: Sliver C2 operator with an automated ScareCrow, Donut and SysWhispers3 build pipeline
- UTA-2026-002: XiebroC2 and Covenant operator working from a Chinese-language build environment
- UTA-2026-004: Developer of the OpenStrike multi-implant C2 toolkit, with a cracked Cobalt Strike arsenal
- UTA-2026-006: Stock AdaptixC2 operator with an operator-written PowerShell and .NET injection chain
- UTA-2026-007: HijackLoader customer running a 15-month multi-vector phishing campaign into an AsyncRAT-class RAT
- UTA-2026-008: Developer and operator of the BellaMain Turkish phishing-as-a-service panel
- UTA-2026-009: Multi-product fraud operator pairing a real VPN service with a brand-impersonation phishing library
- UTA-2026-010: Rhadamanthys MaaS customer with a self-built loader (customer side only, never the vendor)
- UTA-2026-020: Self-branded commodity cryptojacking operator mass-exploiting exposed Chinese enterprise software
- UTA-2026-021: Assembler-model intrusion operator staging other actors' tooling against one German victim forest
ATT&CK v19.2. MITRE ATT&CK® is a registered trademark of The MITRE Corporation; technique names are MITRE's and link to MITRE's own pages. The mapping on each linked page is this publication's reading of its own evidence.