tasklist.exe
Summary
Tasklist (tasklist.exe) displays a list of currently running processes on the local or a remote computer. It can show process names, PIDs, memory usage, session information, and loaded DLLs or services hosted by each process.
tasklist.exe is the 19th most commonly executed Windows program in EchoTrail's dataset, observed 3,566,054 times across enterprise environments. It typically runs from C:\Windows\System32 and it is most often launched by cmd.exe.
Behavior
Top Paths
- C:\Windows\System3299.98%
- C:\Windows\SysWOW640.02%
- C:\Windows\WinSxS\amd64_microsoft-windows-tasklist_31bf3856ad364e35_6.3.9600.17415_none_194e2d182e0f178b<0.01%
Top Hashes (SHA256)
- d0de02e013574b1c6c940a7fb00c671b364d02e36c024ccba5ab9c3904e58d1e52.97%
- 85cf61445bff8550394308f2cb1d81be7380789b3d90e8230bd91757154c0b0017.68%
- be7241a74fe9a9d30e0631e41533a362b21c8f7aae3e5b6ad319cc15c024ec3f12.91%
- 3a0360cd2c4859639198c139722ffadb3e03f9c2e5ec1359832590c3236b4f1d8.69%
- 27eddac6a2e5a74df67c534393b0b025b03d61310748be016dce348a02d30a223.02%
- ecf9258bbeb3de78ced7fe1c7cdbeb2d2eb41ec4d6a4a9d5f0f805f69850d0fa2.24%
- 9fdc5e65a079b0e4429020dbc94ee92c3508433b1faf77059c649b53dbccf3ef1.59%
- a8c1ba92216f53d3b6194f5224a6087fa28e8e5d8954542e0e7e80ab6307a6840.32%
- 113c4d989a47b80905e92c06e48e03b24d44cadbf7bc7e86d948d7da9dc982520.21%
- 31e6a056eb1e722d8ec8c7e152e6a410b12d6055140bc38ffa1ccbd56ad4e6230.19%
Process Ancestry
Top Grandparents
- LTSVC.exe99.96%
- services.exe0.02%
- cmd.exe<0.01%
- explorer.exe<0.01%
- WmiPrvSE.exe<0.01%
- nxserver.bin<0.01%
- MsSense.exe<0.01%
- svchost.exe<0.01%
Top Parents
- cmd.exe99.23%
- QualysAgent.exe0.71%
- java.exe0.03%
- javaw.exe0.01%
- powershell.exe<0.01%
- backgroundTaskHost.exe<0.01%
- SenseCncProxy.exe<0.01%
- chrome.exe<0.01%
- find.exe<0.01%
- HttpHelper.exe<0.01%
Top Children
- conhost.exe99.77%
- netsh.exe0.08%
- powershell.exe0.08%
- WerFault.exe0.08%
Rare or environment-specific process names are omitted from ancestry tables. Percentages are of all observed relationships.
Security Analysis
What does tasklist.exe normally do?
Located in C:\Windows\System32. Predominantly launched by cmd.exe (99.2%) and monitoring agents (QualysAgent). Used in scripted health checks and monitoring. Common flags include /svc (services per process), /m (loaded modules), /v (verbose), /fi (filter).
When is tasklist.exe suspicious?
Like netstat, tasklist alone is not suspicious. Part of discovery enumeration when combined with other recon tools in sequence. Using /s flag to query remote hosts. Combined with find.exe to search for specific security products (tasklist | find "MsMpEng" or "CrowdStrike" — checking if AV/EDR is running). Spawned by unusual parents (w3wp.exe, wmiprvse.exe).
How do attackers abuse tasklist.exe?
Process discovery: attackers enumerate running processes to identify security products (AV, EDR), understand what software is installed, and find processes to target for injection or credential access. Security product detection: tasklist piped to find for AV/EDR process names is a common pre-attack step. If an attacker can identify and disable the security product, they have a better chance of success. Remote process enumeration: tasklist /s <target> provides process lists from remote machines.
Detection guidance
Do not alert on tasklist.exe alone. High-confidence: tasklist.exe with /s flag (remote enumeration). tasklist piped to find searching for security product names. Medium-confidence: tasklist as part of a reconnaissance sequence with netstat, whoami, ipconfig, net user. Use as a component in correlation rules for discovery activity.
False positive notes
Very common in monitoring scripts and management agent routines. QualysAgent and SCCM run tasklist regularly. Some applications (Java-based, PowerPanel) use tasklist for process monitoring.
Related Processes
Ask Rocky about tasklist.exe
Rocky answers questions about tasklist.exe grounded in this same dataset — free, no account needed.
Need this data programmatically? The Rocky API includes 500 free lookups a month. Or just ask Rocky.
Data from EchoTrail's dataset of ~346M Windows process executions. Last extracted 2026-08-04.