tasklist.exe

by Microsoft
Operating Systemmedium risk

Summary

Tasklist (tasklist.exe) displays a list of currently running processes on the local or a remote computer. It can show process names, PIDs, memory usage, session information, and loaded DLLs or services hosted by each process.

tasklist.exe is the 19th most commonly executed Windows program in EchoTrail's dataset, observed 3,566,054 times across enterprise environments. It typically runs from C:\Windows\System32 and it is most often launched by cmd.exe.

19th
most commonly executed Windows program
3,566,054
observed executions
high
statistical confidence

Behavior

Top Paths

  • C:\Windows\System3299.98%
  • C:\Windows\SysWOW640.02%
  • C:\Windows\WinSxS\amd64_microsoft-windows-tasklist_31bf3856ad364e35_6.3.9600.17415_none_194e2d182e0f178b<0.01%

Top Hashes (SHA256)

  • d0de02e013574b1c6c940a7fb00c671b364d02e36c024ccba5ab9c3904e58d1e52.97%
  • 85cf61445bff8550394308f2cb1d81be7380789b3d90e8230bd91757154c0b0017.68%
  • be7241a74fe9a9d30e0631e41533a362b21c8f7aae3e5b6ad319cc15c024ec3f12.91%
  • 3a0360cd2c4859639198c139722ffadb3e03f9c2e5ec1359832590c3236b4f1d8.69%
  • 27eddac6a2e5a74df67c534393b0b025b03d61310748be016dce348a02d30a223.02%
  • ecf9258bbeb3de78ced7fe1c7cdbeb2d2eb41ec4d6a4a9d5f0f805f69850d0fa2.24%
  • 9fdc5e65a079b0e4429020dbc94ee92c3508433b1faf77059c649b53dbccf3ef1.59%
  • a8c1ba92216f53d3b6194f5224a6087fa28e8e5d8954542e0e7e80ab6307a6840.32%
  • 113c4d989a47b80905e92c06e48e03b24d44cadbf7bc7e86d948d7da9dc982520.21%
  • 31e6a056eb1e722d8ec8c7e152e6a410b12d6055140bc38ffa1ccbd56ad4e6230.19%

Process Ancestry

Top Grandparents

Top Parents

Top Children

Rare or environment-specific process names are omitted from ancestry tables. Percentages are of all observed relationships.

Security Analysis

What does tasklist.exe normally do?

Located in C:\Windows\System32. Predominantly launched by cmd.exe (99.2%) and monitoring agents (QualysAgent). Used in scripted health checks and monitoring. Common flags include /svc (services per process), /m (loaded modules), /v (verbose), /fi (filter).

When is tasklist.exe suspicious?

Like netstat, tasklist alone is not suspicious. Part of discovery enumeration when combined with other recon tools in sequence. Using /s flag to query remote hosts. Combined with find.exe to search for specific security products (tasklist | find "MsMpEng" or "CrowdStrike" — checking if AV/EDR is running). Spawned by unusual parents (w3wp.exe, wmiprvse.exe).

How do attackers abuse tasklist.exe?

Process discovery: attackers enumerate running processes to identify security products (AV, EDR), understand what software is installed, and find processes to target for injection or credential access. Security product detection: tasklist piped to find for AV/EDR process names is a common pre-attack step. If an attacker can identify and disable the security product, they have a better chance of success. Remote process enumeration: tasklist /s <target> provides process lists from remote machines.

Detection guidance

Do not alert on tasklist.exe alone. High-confidence: tasklist.exe with /s flag (remote enumeration). tasklist piped to find searching for security product names. Medium-confidence: tasklist as part of a reconnaissance sequence with netstat, whoami, ipconfig, net user. Use as a component in correlation rules for discovery activity.

False positive notes

Very common in monitoring scripts and management agent routines. QualysAgent and SCCM run tasklist regularly. Some applications (Java-based, PowerPanel) use tasklist for process monitoring.

MITRE ATT&CK techniques

Related Processes

Ask Rocky about tasklist.exe

Rocky answers questions about tasklist.exe grounded in this same dataset — free, no account needed.

Need this data programmatically? The Rocky API includes 500 free lookups a month. Or just ask Rocky.

Data from EchoTrail's dataset of ~346M Windows process executions. Last extracted 2026-08-04.