Process Discovery
Process discovery is like a spy looking at a list of all the programs currently open on a computer to figure out what kind of work is being done. By seeing these programs, the spy can identify if the computer is being used for AI tasks, which helps them decide how to attack it next.
Process discovery is the act of enumerating active processes on a host to identify the software stack. In an AI security context, this allows an adversary to detect specific AI frameworks, libraries, or applications, which helps them map out potential attack vectors, such as targeting application tokens or sensitive backend services.
Process discovery is a reconnaissance technique used to enumerate active processes on a system to gain situational awareness of the environment. Adversaries leverage native utilities (e.g., tasklist, ps) or API calls (e.g., CreateToolhelp32Snapshot) to identify AI-related software, which serves as a precursor to identifying vulnerabilities, credential access, or lateral movement opportunities within an AI-integrated infrastructure.