{"id":"T1007","name":"System Service Discovery","url":"https://attack.mitre.org/techniques/T1007","tactics":["discovery"],"platforms":["Linux","macOS","Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0483","stix_id":"x-mitre-detection-strategy--d8e8768e-34c1-45f4-95d2-fa7ba317b63a","name":"Detection of System Service Discovery Commands Across OS Platforms","url":"https://attack.mitre.org/detectionstrategies/DET0483","analytics":[{"id":"AN1325","stix_id":"x-mitre-analytic--475313b7-c26f-44f6-a8f3-09b57f03fcd8","name":"Analytic 1325","description":"Enumeration of services via native CLI tools (e.g., `sc query`, `tasklist /svc`, `net start`) or API calls via PowerShell and WMI.","url":"https://attack.mitre.org/detectionstrategies/DET0483#AN1325","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Security","channel":"EventCode=4688","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-security"},{"name":"WinEventLog:PowerShell","channel":"EventCode=4103, 4104, 4105, 4106","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"wineventlog-powershell"}],"mutable_elements":[{"field":"ProcessName","description":"Can be tuned to specific binaries used for service enumeration (e.g., `sc.exe`, `tasklist.exe`)."},{"field":"CommandLineMatch","description":"Filters for variations like `sc query`, `net start`, `Get-Service`."},{"field":"ParentProcess","description":"Used to suppress known admin scripts or automation jobs."}],"live":true,"detection_strategies":["DET0483"],"techniques":["T1007"]},{"id":"AN1326","stix_id":"x-mitre-analytic--20879a60-f16c-4a90-bd71-2c8865c99481","name":"Analytic 1326","description":"Execution of service management commands like `systemctl list-units`, `service --status-all`, or direct reading of `/etc/init.d`.","url":"https://attack.mitre.org/detectionstrategies/DET0483#AN1326","platforms":["Linux"],"log_source_references":[{"name":"auditd:EXECVE","channel":"execve","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"auditd-execve"}],"mutable_elements":[{"field":"CommandPattern","description":"Includes service enumeration commands like `systemctl`, `service`, or custom scripts."},{"field":"ExecutionUser","description":"Tunable by user context (e.g., root vs. standard user)."},{"field":"TimeWindow","description":"Used for correlation with privilege escalation or lateral movement."}],"live":true,"detection_strategies":["DET0483"],"techniques":["T1007"]},{"id":"AN1327","stix_id":"x-mitre-analytic--8f654b08-222f-4fc0-83cc-ab871e290d1e","name":"Analytic 1327","description":"Discovery via launchctl commands, or process enumeration using `ps aux | grep com.apple.` to identify daemons and services.","url":"https://attack.mitre.org/detectionstrategies/DET0483#AN1327","platforms":["macOS"],"log_source_references":[{"name":"macos:unifiedlog","channel":"None","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"macos-unifiedlog"},{"name":"macos:osquery","channel":"process_events","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"macos-osquery"}],"mutable_elements":[{"field":"CommandLineContent","description":"Tune to recognize `launchctl list`, `launchctl print`, or service grep strings."},{"field":"ProcessParent","description":"Filter known benign automation or MDM agent invocations."}],"live":true,"detection_strategies":["DET0483"],"techniques":["T1007"]}],"live":true,"version":"1.0","techniques":["T1007"]}],"sigma_rules":[{"id":"064060aa-09fb-4636-817f-020a32aa7e9e","title":"Potential Registry Reconnaissance Via PowerShell Script","author":"frack113","status":"test","level":"medium","date":"2023-07-02","modified":null,"description":"Detects PowerShell scripts with potential registry reconnaissance capabilities. Adversaries may interact with the Windows registry to gather information about the system credentials, configuration, and installed software.","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1012/T1012.md"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.discovery","attack.t1012","attack.t1007","detection.threat-hunting"],"path":"rules-threat-hunting/windows/powershell/powershell_script/posh_ps_registry_reconnaissance.yml","techniques":["T1012","T1007"],"cves":[]},{"id":"183e7ea8-ac4b-4c23-9aec-b3dac4e401ac","title":"Net.EXE Execution","author":"Michael Haag, Mark Woan (improvements), James Pemberton / @4A616D6573 / oscd.community (improvements)","status":"test","level":"low","date":"2019-01-16","modified":"2022-07-11","description":"Detects execution of \"Net.EXE\".","references":["https://pentest.blog/windows-privilege-escalation-methods-for-pentesters/","https://eqllib.readthedocs.io/en/latest/analytics/4d2e7fc1-af0b-4915-89aa-03d25ba7805e.html","https://eqllib.readthedocs.io/en/latest/analytics/e61f557c-a9d0-4c25-ab5b-bbc46bb24deb.html","https://eqllib.readthedocs.io/en/latest/analytics/9b3dd402-891c-4c4d-a662-28947168ce61.html","https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1007/T1007.md#atomic-test-2---system-service-discovery---netexe"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.discovery","attack.t1007","attack.t1049","attack.t1018","attack.t1135","attack.t1201","attack.t1069.001","attack.t1069.002","attack.t1087.001","attack.t1087.002","attack.lateral-movement","attack.t1021.002","attack.s0039","detection.threat-hunting"],"path":"rules-threat-hunting/windows/process_creation/proc_creation_win_net_execution.yml","techniques":["T1007","T1049","T1018","T1135","T1201","T1069.001","T1069.002","T1087.001","T1087.002","T1021.002"],"cves":[]},{"id":"33e814e0-1f00-4e43-9c34-31fb7ae2b174","title":"ESXi Network Configuration Discovery Via ESXCLI","author":"Cedric Maurugeon","status":"test","level":"medium","date":"2023-09-04","modified":null,"description":"Detects execution of the \"esxcli\" command with the \"network\" flag in order to retrieve information about the network configuration.","references":["https://www.crowdstrike.com/blog/hypervisor-jackpotting-ecrime-actors-increase-targeting-of-esxi-servers/","https://developer.broadcom.com/xapis/esxcli-command-reference/7.0.0/namespace/esxcli_network.html"],"logsource":{"product":"linux","category":"process_creation"},"tags":["attack.discovery","attack.execution","attack.t1033","attack.t1007","attack.t1059.012"],"path":"rules/linux/process_creation/proc_creation_lnx_esxcli_network_discovery.yml","techniques":["T1033","T1007","T1059.012"],"cves":[]},{"id":"403ed92c-b7ec-4edd-9947-5b535ee12d46","title":"Crontab Enumeration","author":"Joseliyo Sanchez, @Joseliyo_Jstnk","status":"test","level":"low","date":"2023-06-02","modified":null,"description":"Detects usage of crontab to list the tasks of the user","references":["https://blogs.jpcert.or.jp/en/2023/05/gobrat.html","https://jstnk9.github.io/jstnk9/research/GobRAT-Malware/","https://www.virustotal.com/gui/file/60bcd645450e4c846238cf0e7226dc40c84c96eba99f6b2cffcd0ab4a391c8b3/detection","https://www.virustotal.com/gui/file/3e44c807a25a56f4068b5b8186eee5002eed6f26d665a8b791c472ad154585d1/detection"],"logsource":{"product":"linux","category":"process_creation"},"tags":["attack.discovery","attack.t1007"],"path":"rules/linux/process_creation/proc_creation_lnx_crontab_enumeration.yml","techniques":["T1007"],"cves":[]},{"id":"57712d7a-679c-4a41-a913-87e7175ae429","title":"SC.EXE Query Execution","author":"frack113","status":"test","level":"low","date":"2021-12-06","modified":"2024-02-08","description":"Detects execution of \"sc.exe\" to query information about registered services on the system","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1007/T1007.md#atomic-test-1---system-service-discovery"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.discovery","attack.t1007","detection.threat-hunting"],"path":"rules-threat-hunting/windows/process_creation/proc_creation_win_sc_query.yml","techniques":["T1007"],"cves":[]},{"id":"5f1573a7-363b-4114-9208-ad7a61de46eb","title":"ESXi VM List Discovery Via ESXCLI","author":"Cedric Maurugeon","status":"test","level":"medium","date":"2023-09-04","modified":null,"description":"Detects execution of the \"esxcli\" command with the \"vm\" flag in order to retrieve information about the installed VMs.","references":["https://www.crowdstrike.com/blog/hypervisor-jackpotting-ecrime-actors-increase-targeting-of-esxi-servers/","https://developer.broadcom.com/xapis/esxcli-command-reference/7.0.0/namespace/esxcli_vm.html","https://www.secuinfra.com/en/techtalk/hide-your-hypervisor-analysis-of-esxiargs-ransomware/","https://www.trendmicro.com/en_us/research/22/e/new-linux-based-ransomware-cheerscrypt-targets-exsi-devices.html"],"logsource":{"product":"linux","category":"process_creation"},"tags":["attack.discovery","attack.execution","attack.t1033","attack.t1007","attack.t1059.012"],"path":"rules/linux/process_creation/proc_creation_lnx_esxcli_vm_discovery.yml","techniques":["T1033","T1007","T1059.012"],"cves":[]},{"id":"970007b7-ce32-49d0-a4a4-fbef016950bd","title":"Potential Configuration And Service Reconnaissance Via Reg.EXE","author":"Timur Zinniatullin, oscd.community","status":"test","level":"medium","date":"2019-10-21","modified":"2023-02-05","description":"Detects the usage of \"reg.exe\" in order to query reconnaissance information from the registry. Adversaries may interact with the Windows registry to gather information about credentials, the system, configuration, and installed software.","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1012/T1012.md"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.discovery","attack.t1012","attack.t1007"],"path":"rules/windows/process_creation/proc_creation_win_reg_query_registry.yml","techniques":["T1012","T1007"],"cves":[]},{"id":"d54c2f06-aca9-4e2b-81c9-5317858f4b79","title":"ESXi VSAN Information Discovery Via ESXCLI","author":"Nasreddine Bencherchali (Nextron Systems), Cedric Maurugeon","status":"test","level":"medium","date":"2023-09-04","modified":null,"description":"Detects execution of the \"esxcli\" command with the \"vsan\" flag in order to retrieve information about virtual storage. Seen used by malware such as DarkSide.","references":["https://www.trendmicro.com/en_us/research/21/e/darkside-linux-vms-targeted.html","https://www.trendmicro.com/en_us/research/22/a/analysis-and-Impact-of-lockbit-ransomwares-first-linux-and-vmware-esxi-variant.html","https://developer.broadcom.com/xapis/esxcli-command-reference/7.0.0/namespace/esxcli_vsan.html"],"logsource":{"product":"linux","category":"process_creation"},"tags":["attack.discovery","attack.execution","attack.t1033","attack.t1007","attack.t1059.012"],"path":"rules/linux/process_creation/proc_creation_lnx_esxcli_vsan_discovery.yml","techniques":["T1033","T1007","T1059.012"],"cves":[]},{"id":"e80273e1-9faf-40bc-bd85-dbaff104c4e9","title":"ESXi System Information Discovery Via ESXCLI","author":"Cedric Maurugeon","status":"test","level":"medium","date":"2023-09-04","modified":null,"description":"Detects execution of the \"esxcli\" command with the \"system\" flag in order to retrieve information about the different component of the system. Such as accounts, modules, NTP, etc.","references":["https://www.crowdstrike.com/blog/hypervisor-jackpotting-ecrime-actors-increase-targeting-of-esxi-servers/","https://developer.broadcom.com/xapis/esxcli-command-reference/7.0.0/namespace/esxcli_system.html"],"logsource":{"product":"linux","category":"process_creation"},"tags":["attack.discovery","attack.execution","attack.t1033","attack.t1007","attack.t1059.012"],"path":"rules/linux/process_creation/proc_creation_lnx_esxcli_system_discovery.yml","techniques":["T1033","T1007","T1059.012"],"cves":[]},{"id":"f41dada5-3f56-4232-8503-3fb7f9cf2d60","title":"ESXi Storage Information Discovery Via ESXCLI","author":"Nasreddine Bencherchali (Nextron Systems), Cedric Maurugeon","status":"test","level":"medium","date":"2023-09-04","modified":null,"description":"Detects execution of the \"esxcli\" command with the \"storage\" flag in order to retrieve information about the storage status and other related information. Seen used by malware such as DarkSide and LockBit.","references":["https://www.trendmicro.com/en_us/research/21/e/darkside-linux-vms-targeted.html","https://www.trendmicro.com/en_us/research/22/a/analysis-and-Impact-of-lockbit-ransomwares-first-linux-and-vmware-esxi-variant.html","https://developer.broadcom.com/xapis/esxcli-command-reference/7.0.0/namespace/esxcli_storage.html"],"logsource":{"product":"linux","category":"process_creation"},"tags":["attack.discovery","attack.execution","attack.t1033","attack.t1007","attack.t1059.012"],"path":"rules/linux/process_creation/proc_creation_lnx_esxcli_storage_discovery.yml","techniques":["T1033","T1007","T1059.012"],"cves":[]},{"id":"fca949cc-79ca-446e-8064-01aa7e52ece5","title":"HackTool - PCHunter Execution","author":"Florian Roth (Nextron Systems), Nasreddine Bencherchali","status":"test","level":"high","date":"2022-10-10","modified":"2024-11-23","description":"Detects suspicious use of PCHunter, a tool like Process Hacker to view and manipulate processes, kernel options and other low level stuff","references":["https://web.archive.org/web/20231210115125/http://www.xuetr.com/","https://www.crowdstrike.com/blog/falcon-overwatch-report-finds-increase-in-ecrime/","https://www.hexacorn.com/blog/2018/04/20/kernel-hacking-tool-you-might-have-never-heard-of-xuetr-pchunter/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.discovery","attack.t1082","attack.t1057","attack.t1012","attack.t1083","attack.t1007"],"path":"rules/windows/process_creation/proc_creation_win_hktl_pchunter.yml","techniques":["T1082","T1057","T1012","T1083","T1007"],"cves":[]}],"kev_cves":[{"cveID":"CVE-2019-1653","state":"mapped","mapping_types":["secondary_impact"]}],"_built":"2026-08-23 05:47 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}