Part of my ongoing Wazuh detection engineering lab series
What Is Process Discovery?
Process discovery is an attacker asking the question: what's running on this machine? Think of it like walking into a room and turning on the lights — they're not doing anything yet, just looking around to understand what they're working with.
This technique is documented in MITRE ATT&CK as T1057, under the Discovery tactic (TA0007). It typically happens after initial access but before lateral movement or impact.
Common tools attackers use on Windows:
tasklist.exe— native Windows command line toolwmic process list— Windows Management InstrumentationGet-Processorpsin PowerShell
These are Living Off the Land Binaries (LOLBINs) — legitimate tools built into Windows, trusted by the OS, no download required.
The Rule Structure
Each tool an attacker uses is like flipping a different light switch. The goal isn't to wait until they've tried every switch — it's to raise the alarm the moment any single one gets flipped.
Rather than writing one rule per tool and ending up with three separate disconnected alerts, the structure here is two layers:
Layer 1 — Individual detection rules: One rule per tool, each silently tagging the event with a shared group label. No high-level alert on their own.
Layer 2 — Correlation rule: Listens for any of the individual rules firing. The moment one fires, a single level 10 alert is produced.
One tool used once = one clean, actionable alert, regardless of which tool the attacker chose.
What Didn't Work
Frequency of 1 isn't valid. The initial correlation rule used frequency=1, which crashed the Wazuh manager on startup. Wazuh requires frequency to be a minimum of 2, and even then it means the group must fire that many additional times beyond the first hit — making it useless for detecting a single reconnaissance event. Frequency was removed entirely in favour of if_sid listening directly for the individual rule IDs.
Get-Process isn't visible to Sysmon by default. Running Get-Process inside an existing PowerShell session doesn't create a new process, so Sysmon Event ID 1 never fires. It only becomes detectable when PowerShell is launched with it as a command line argument: powershell.exe -Command Get-Process.
Wazuh's default rule fires first for PowerShell. When PowerShell spawns another PowerShell instance, Wazuh's own rule 92027 matches the event before any custom rule can. Rather than trying to override it, the PowerShell detection rule chains off 92027 as its parent and adds a commandLine check for Get-Process. Building on top of what already exists rather than fighting it.
wmic is removed from Windows 11. The rule was written and would apply to Windows 10 endpoints, but couldn't be tested locally. Worth noting for production environments where multiple OS versions are in scope.
How the Detection Works
When tasklist.exe runs → Sysmon captures process creation → individual rule matches and tags the event → correlation rule fires immediately at level 10.
When powershell.exe -Command Get-Process runs → Sysmon captures it → Wazuh's default rule 92027 fires → custom rule chains off it and checks the command line → correlation rule fires immediately at level 10.
Either path, one alert. MITRE T1057 tagged, Discovery tactic mapped.