Millenium RAT Process Enumeration via tasklist.exe or Snapshot APIs

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

Detects execution of 'tasklist.exe' when spawned by suspicious or unexpected parent processes, specifically flagging instances where the parent process resides in an AppData directory or originates from specific executables often leveraged by malicious actors. This behavior is indicative of system enumeration and discovery activity.