Techniques › T1007
T1007 System Service Discovery
discovery — Linux, macOS, Windows · attack.mitre.org · JSON
1
MITRE detection strategy
3
analytics
11
Sigma rules tagged attack.t1007
1
KEV CVEs mapped here
<p>Adversaries may try to gather information about registered local system services. Adversaries may obtain information about services using tools as well as OS utility commands such as <code>sc query</code>, <code>tasklist /svc</code>, <code>systemctl --type=service</code>, and <code>net start</code>. Adversaries may also gather information about schedule tasks via commands such as
schtasks on Windows or crontab -l on Linux and macOS.</p><p>Adversaries may use the information from System Service Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.</p>KEV CVEs mapped to this technique · CTID Mappings Explorer
| CVE | Vendor / product | Mapping type | State | Added |
|---|---|---|---|---|
| CVE-2019-1653 | Cisco Small Business RV320 and RV325 Routers | secondary impact | Mapped | 2021-11-03 |
Detection strategy · ATT&CK Enterprise v19.2
- DET0483 Detection of System Service Discovery Commands Across OS Platforms v1.0
AN1325 WindowsEnumeration of services via native CLI tools (e.g.,
sc query,tasklist /svc,net start) or API calls via PowerShell and WMI.Tunable:ProcessNameCommandLineMatchParentProcessAN1326 LinuxExecution of service management commands likesystemctl list-units,service --status-all, or direct reading of/etc/init.d.Tunable:CommandPatternExecutionUserTimeWindowAN1327 macOSDiscovery via launchctl commands, or process enumeration usingps aux | grep com.apple.to identify daemons and services.Tunable:CommandLineContentProcessParent
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1007
Author: frack113
· 2023-07-02 · logsource: product=windows category=ps_script · 064060aa-09fb-4636-817f-020a32aa7e9e
Detects PowerShell scripts with potential registry reconnaissance capabilities. Adversaries may interact with the Windows registry to gather information about the system credentials, configuration, and installed software.
Author: Michael Haag, Mark Woan (improvements), James Pemberton / @4A616D6573 / oscd.community (improvements)
· 2019-01-16 (modified 2022-07-11) · logsource: product=windows category=process_creation · 183e7ea8-ac4b-4c23-9aec-b3dac4e401ac
Detects execution of "Net.EXE".
Author: Cedric Maurugeon
· 2023-09-04 · logsource: product=linux category=process_creation · 33e814e0-1f00-4e43-9c34-31fb7ae2b174
Detects execution of the "esxcli" command with the "network" flag in order to retrieve information about the network configuration.
Author: Joseliyo Sanchez, @Joseliyo_Jstnk
· 2023-06-02 · logsource: product=linux category=process_creation · 403ed92c-b7ec-4edd-9947-5b535ee12d46
Detects usage of crontab to list the tasks of the user
Author: frack113
· 2021-12-06 (modified 2024-02-08) · logsource: product=windows category=process_creation · 57712d7a-679c-4a41-a913-87e7175ae429
Detects execution of "sc.exe" to query information about registered services on the system
Author: Cedric Maurugeon
· 2023-09-04 · logsource: product=linux category=process_creation · 5f1573a7-363b-4114-9208-ad7a61de46eb
Detects execution of the "esxcli" command with the "vm" flag in order to retrieve information about the installed VMs.
Author: Timur Zinniatullin, oscd.community
· 2019-10-21 (modified 2023-02-05) · logsource: product=windows category=process_creation · 970007b7-ce32-49d0-a4a4-fbef016950bd
Detects the usage of "reg.exe" in order to query reconnaissance information from the registry. Adversaries may interact with the Windows registry to gather information about credentials, the system, configuration, and installed software.
Author: Nasreddine Bencherchali (Nextron Systems), Cedric Maurugeon
· 2023-09-04 · logsource: product=linux category=process_creation · d54c2f06-aca9-4e2b-81c9-5317858f4b79
Detects execution of the "esxcli" command with the "vsan" flag in order to retrieve information about virtual storage. Seen used by malware such as DarkSide.
Author: Cedric Maurugeon
· 2023-09-04 · logsource: product=linux category=process_creation · e80273e1-9faf-40bc-bd85-dbaff104c4e9
Detects execution of the "esxcli" command with the "system" flag in order to retrieve information about the different component of the system. Such as accounts, modules, NTP, etc.
Author: Nasreddine Bencherchali (Nextron Systems), Cedric Maurugeon
· 2023-09-04 · logsource: product=linux category=process_creation · f41dada5-3f56-4232-8503-3fb7f9cf2d60
Detects execution of the "esxcli" command with the "storage" flag in order to retrieve information about the storage status and other related information. Seen used by malware such as DarkSide and LockBit.
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali
· 2022-10-10 (modified 2024-11-23) · logsource: product=windows category=process_creation · fca949cc-79ca-446e-8064-01aa7e52ece5
Detects suspicious use of PCHunter, a tool like Process Hacker to view and manipulate processes, kernel options and other low level stuff