Skip to content

Tasklist

Software · ATTACK:enterprise:S0057

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:S0057",
  "title": "Tasklist",
  "type": "Software",
  "source_url": "https://attack.mitre.org/software/S0057",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "tool--2e45723a-31da-4a7e-aaa6-e01998a6788f",
  "external_id": "S0057",
  "domain": "enterprise",
  "created": "2017-05-31T21:32:39.233Z",
  "modified": "2026-05-12T15:12:00.740Z",
  "version": "1.3",
  "aliases": [

  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "Microsoft Tasklist",
      "url": "https://technet.microsoft.com/en-us/library/bb491010.aspx"
    }
  ]
}

Explicit source assertions (19)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:G1053 → uses → ATTACK:enterprise:S0057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--07155ad6-9833-4acd-b3d4-501bcb949d73

Microsoft Storm-501 Sabbath Ransomware Embargo September 2024

ATTACK:enterprise:G1023 → uses → ATTACK:enterprise:S0057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0d9b3bc8-8aff-4556-9a5f-1d4f91eb93b9

Mandiant Pulse Secure Update May 2021

ATTACK:enterprise:G0016 → uses → ATTACK:enterprise:S0057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--13cd473c-1953-45d2-8508-faf8c1b6a941

CISA SoreFang July 2016

ATTACK:enterprise:S0057 → uses → ATTACK:enterprise:T1057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--32a470e7-4bbc-43e8-ae8e-09b382dd441f

Microsoft Tasklist

ATTACK:enterprise:G1054 → uses → ATTACK:enterprise:S0057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--36e92e54-f1be-485e-b9da-ec5197f9a000

JPCERT MirrorFace JUL 2024

ATTACK:enterprise:G0049 → uses → ATTACK:enterprise:S0057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3beb0c09-e584-4fd8-92bb-d7a1ae9192e6

Palo Alto OilRig May 2016 · FireEye APT34 Dec 2017

ATTACK:enterprise:S0057 → uses → ATTACK:enterprise:T1007

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--40c5a024-37db-478b-b90f-27f184bf8f60

Microsoft Tasklist

ATTACK:enterprise:G0004 → uses → ATTACK:enterprise:S0057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--59223275-a57b-45ca-94b6-5c504165d8f9

NCC Group APT15 Alive and Strong

ATTACK:enterprise:G1006 → uses → ATTACK:enterprise:S0057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--62a11eb5-d59b-49d3-b4b5-d88e3cb4e538

TrendMicro EarthLusca 2022

ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:S0057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6784ef17-912c-4319-87b4-4279c8b663b3

CISA AA24-038A PRC Critical Infrastructure February 2024 · Secureworks BRONZE SILHOUETTE May 2023 · Joint Cybersecurity Advisory Volt Typhoon June 2023

ATTACK:enterprise:G0006 → uses → ATTACK:enterprise:S0057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--79cd2ec8-068c-4a7a-8133-1855381d3bd3

ATTACK:enterprise:S0057 → uses → ATTACK:enterprise:T1518.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--80ca0faf-6958-4158-a36d-b3e7936c5f5a

Microsoft Tasklist

ATTACK:enterprise:G0027 → uses → ATTACK:enterprise:S0057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--88c2feed-474e-427c-a0ed-6a4e1576b145

Trend Micro DRBControl February 2020

ATTACK:enterprise:G0009 → uses → ATTACK:enterprise:S0057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9d081347-3446-47a4-b5a9-d7a9d2d499e7

Alperovitch 2014

ATTACK:enterprise:C0007 → uses → ATTACK:enterprise:S0057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a77f2c84-7538-48f5-8809-df2fa47ab6df

Bitdefender FunnyDream Campaign November 2020

ATTACK:enterprise:C0006 → uses → ATTACK:enterprise:S0057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--abb6d14e-e76f-4437-8006-1a084ecd5e1b

McAfee Honeybee

ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:S0057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bd2a23f7-88cd-47d2-b30e-9356d0204a8e

Kaspersky Turla

ATTACK:enterprise:C0063 → uses → ATTACK:enterprise:S0057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cd424d91-ee2c-4a63-bbeb-e18cd4ed2d1d

ATTACK:enterprise:G0019 → uses → ATTACK:enterprise:S0057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f2d601c9-8cc7-4425-b76f-fbc9997b55fd

Baumgartner Naikon 2015

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.