ATT&CK T1057 - Process List Request via Web Shell

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•1

This rule detects attempts to list processes via a web shell by looking for the string "tasklist" (case-insensitive) in the HTTP URI. This activity is indicative of an attacker using a compromised web server to gain information about the system, specifically process enumeration, which aligns with the MITRE ATT&CK technique T1057 (Process Discovery).