Process Discovery via Native Utilities

Danny Y@zendannyy

•updated Jun 8, 2026•3•0•13

Attempts to discover running processes on a Windows system using either native utilities or PowerShell commands/API calls. Adversaries often use these methods to gain information about running processes as part of discovery. Hunting rule, not a drop in detection