MITRE ATT&CKtechnique

T1007 System Service Discovery

Published 2017-05-31 Modified 2026-05-12 Official page ↗
Domain
enterprise
Tactics
Discovery
Platforms
Linux, macOS, Windows
Version
1.6
Created
2017-05-31

Description

Adversaries may try to gather information about registered local system services. Adversaries may obtain information about services using tools as well as OS utility commands such as sc query, tasklist /svc, systemctl --type=service, and net start. Adversaries may also gather information about schedule tasks via commands such as `schtasks` on Windows or `crontab -l` on Linux and macOS. Adversaries may use the information from System Service Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.

Related

Tactic · MITRE ATT&CK (1)

Referenced by MITRE ATT&CK · uses (70)

  • G1059 NIMBUS MANTICORE group
  • S9035 LAMEHUG software (malware)
  • G1054 MirrorFace group
  • S1247 Embargo software (malware)
  • S1244 Medusa Ransomware software (malware)
  • S1242 Qilin software (malware)
  • S1228 PUBLOAD software (malware)
  • S1085 Sardonic software (malware)
  • G1017 Volt Typhoon group
  • S1070 Black Basta software (malware)
  • S1066 DarkTortilla software (malware)
  • C0014 Operation Wocao campaign
  • C0012 Operation CuckooBees campaign
  • S1027 Heyoka Backdoor software (malware)
  • G1006 Earth Lusca group
  • S0692 SILENTTRINITY software (tool)
  • G0143 Aquatic Panda group
  • S0663 SysUpdate software (malware)
  • G0139 TeamTNT group
  • S0638 Babuk software (malware)
  • S0629 RainyDay software (malware)
  • S0625 Cuba software (malware)
  • S0615 SombRAT software (malware)
  • S0582 LookBack software (malware)
  • S0572 Caterpillar WebShell software (malware)
  • S0570 BitPaymer software (malware)
  • G0119 Indrik Spider group
  • S0559 SUNBURST software (malware)
  • S0533 SLOTHFULMEDIA software (malware)
  • G0114 Chimera group
Show all 70 ›

Referenced by CAPEC · att&ck technique (1)

  • CAPEC-574 Services Footprinting attack pattern

References