tasklist.exe
Sources: 300M+ executions observed in the wild.
Summary
Tasklist (tasklist.exe) displays a list of currently running processes on the local or a remote computer. It can show process names, PIDs, memory usage, session information, and loaded DLLs or services hosted by each process.
tasklist.exe is the 19th most commonly executed Windows program in EchoTrail's dataset, observed 3,566,054 times across enterprise environments. It typically runs from C:\Windows\System32 and it is most often launched by cmd.exe.
Get this in your tools
The same record for tasklist.exe, by REST or as an MCP tool. Free key, no card.
curl -H "Authorization: Bearer $ECHOTRAIL_KEY" \
https://api.echotrail.io/v1/process/tasklist.exeFree returns the summary. Team returns the full record you see on this page. Endpoint docs
Behavior
Top Paths
- C:\Windows\System3299.98%
- C:\Windows\SysWOW640.02%
- C:\Windows\WinSxS\amd64_microsoft-windows-tasklist_31bf3856ad364e35_6.3.9600.17415_none_194e2d182e0f178b<0.01%
Top Hashes (SHA256)
- d0de02e013574b1c6c940a7fb00c671b364d02e36c024ccba5ab9c3904e58d1e52.97%
- 85cf61445bff8550394308f2cb1d81be7380789b3d90e8230bd91757154c0b0017.68%
- be7241a74fe9a9d30e0631e41533a362b21c8f7aae3e5b6ad319cc15c024ec3f12.91%
- 3a0360cd2c4859639198c139722ffadb3e03f9c2e5ec1359832590c3236b4f1d8.69%
- 27eddac6a2e5a74df67c534393b0b025b03d61310748be016dce348a02d30a223.02%
- ecf9258bbeb3de78ced7fe1c7cdbeb2d2eb41ec4d6a4a9d5f0f805f69850d0fa2.24%
- 9fdc5e65a079b0e4429020dbc94ee92c3508433b1faf77059c649b53dbccf3ef1.59%
- a8c1ba92216f53d3b6194f5224a6087fa28e8e5d8954542e0e7e80ab6307a6840.32%
- 113c4d989a47b80905e92c06e48e03b24d44cadbf7bc7e86d948d7da9dc982520.21%
- 31e6a056eb1e722d8ec8c7e152e6a410b12d6055140bc38ffa1ccbd56ad4e6230.19%
Process Ancestry
Top Grandparents
- LTSVC.exe99.96%
- services.exe0.02%
- cmd.exe<0.01%
- explorer.exe<0.01%
- WmiPrvSE.exe<0.01%
- nxserver.bin<0.01%
- MsSense.exe<0.01%
- svchost.exe<0.01%
Top Parents
- cmd.exe99.23%
- QualysAgent.exe0.71%
- java.exe0.03%
- javaw.exe0.01%
- powershell.exe<0.01%
- backgroundTaskHost.exe<0.01%
- SenseCncProxy.exe<0.01%
- chrome.exe<0.01%
- find.exe<0.01%
- HttpHelper.exe<0.01%
Top Children
- conhost.exe99.77%
- netsh.exe0.08%
- powershell.exe0.08%
- WerFault.exe0.08%
Security Analysis
What does tasklist.exe normally do?
Located in C:\Windows\System32. Predominantly launched by cmd.exe (99.2%) and monitoring agents (QualysAgent). Used in scripted health checks and monitoring. Common flags include /svc (services per process), /m (loaded modules), /v (verbose), /fi (filter).
When is tasklist.exe suspicious?
Like netstat, tasklist alone is not suspicious. Part of discovery enumeration when combined with other recon tools in sequence. Using /s flag to query remote hosts. Combined with find.exe to search for specific security products (tasklist | find "MsMpEng" or "CrowdStrike" — checking if AV/EDR is running). Spawned by unusual parents (w3wp.exe, wmiprvse.exe).
How do attackers abuse tasklist.exe?
Process discovery: attackers enumerate running processes to identify security products (AV, EDR), understand what software is installed, and find processes to target for injection or credential access. Security product detection: tasklist piped to find for AV/EDR process names is a common pre-attack step. If an attacker can identify and disable the security product, they have a better chance of success. Remote process enumeration: tasklist /s <target> provides process lists from remote machines.
Detection guidance
Do not alert on tasklist.exe alone. High-confidence: tasklist.exe with /s flag (remote enumeration). tasklist piped to find searching for security product names. Medium-confidence: tasklist as part of a reconnaissance sequence with netstat, whoami, ipconfig, net user. Use as a component in correlation rules for discovery activity.
False positive notes
Very common in monitoring scripts and management agent routines. QualysAgent and SCCM run tasklist regularly. Some applications (Java-based, PowerPanel) use tasklist for process monitoring.
Related Processes
Ask Rocky about tasklist.exe
Rocky is the free chat demo. It answers from this same dataset, no account needed.
This page is the Team-tier API record for tasklist.exe. The free tier returns the summary, 500 lookups a month. Or ask Rocky.