tfMITRE ATT&CK technique

System Service Discovery T1007

Tactic: Discovery
Platforms: Linux, macOS, Windows
Version: 1.6
Created: 31 May 2017
Last modified: 12 May 2026
Contributor: Harshal Tupsamudre, Qualys

Adversaries may try to gather information about registered local system services. Adversaries may obtain information about services using tools as well as OS utility commands such as sc query, tasklist /svc, systemctl --type=service, and net start. Adversaries may also gather information about schedule tasks via commands such as schtasks on Windows or crontab -l on Linux and macOS.[1][2][3][4]

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsTop 12%

Threat groups88th percentile · 88% of ATT&CK techniques have this many threat groups attributed or fewer.

CampaignsTop 17%

Campaigns83rd percentile · 83% of ATT&CK techniques have this many campaigns recorded or fewer.

Tools & malwareTop 7%

Tools & malware93rd percentile · 93% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rulesTop 19%

Detection rules81st percentile · 81% of ATT&CK techniques have this many detection rules written or fewer.

System Service Discovery MITRE reference T1007

Top 12%of all ATT&CK techniques for number of groups

15 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

MirrorFaceG1054 ↗

Has used Tasklist for discovery post compromise.1

created 2026-04-171 referenceaka Earth Kasha

Volt TyphoonG1017 ↗

Has used net start to list running services.1

created 2023-07-271 referenceaka BRONZE SILHOUETTE

Earth LuscaG1006 ↗

Has used Tasklist to obtain information from a compromised host.1

created 2022-07-011 referenceaka TAG-22

Aquatic PandaG0143 ↗

Has attempted to discover services for third party EDR products.1

created 2022-01-181 reference

TeamTNTG0139 ↗

Has searched for services such as Alibaba Cloud Security's aliyun service and BMC Helix Cloud Security's bmc-agent service in order to disable them.1

created 2021-10-011 reference

Indrik SpiderG0119 ↗

Has used the win32_service WMI class to retrieve a list of services from the system.1

created 2021-01-061 referenceaka Evil Corp

All 15 groups for this technique · 6 newest in this preview

2 campaigns have been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.

Operation CuckooBeesC0012 ↗

During Operation CuckooBees, the threat actors used the net start command as part of their initial reconnaissance.1

2019–2022

Operation WocaoC0014 ↗

During Operation Wocao, threat actors used the tasklist command to search for one of its backdoors.1

2017–2019

All 2 campaigns for this technique

52 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.

LAMEHUGS9035 ↗

Can gather service information on targeted systems.1 2

created 2026-04-21MALWAREcarried by 1 group

EmbargoS1247 ↗

Has obtained active services running on the victim’s system through the functions OpenSCManagerW() and EnumServicesStatusExW().1

created 2025-10-19MALWAREcarried by 1 group

Medusa RansomwareS1244 ↗

Has leveraged an encoded list of services that it designates for termination.1 2 3

created 2025-10-17MALWAREcarried by 1 group

QilinS1242 ↗

Can identify specific services for termination or to be left running at execution.1 2 3 4

created 2025-09-26MALWAREcarried by 2 groups

PUBLOADS1228 ↗

Has leveraged tasklist to gather running services on victim host.1

created 2025-08-04MALWAREcarried by 1 group

SardonicS1085 ↗

Has the ability to execute the net start command.1

created 2023-09-05MALWAREcarried by 1 group

All 52 software entries for this technique · 6 newest in this preview

Offense vs defense T1007

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 2Sigma rules (cumulative) · 11Splunk ESCU (cumulative) · 2

first rule: 2019 Q1 · 2 of 2 campaigns plotted

System Service Discovery detection strategy DET0483

MITRE names one behaviour worth catching for this technique and breaks it into 3 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection of System Service Discovery Commands Across OS Platforms

Enterprise

3 platforms

AN1325 · Windows

Enumeration of services via native CLI tools (e.g., sc query, tasklist /svc, net start) or API calls via PowerShell and WMI.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	WinEventLog:Security	EventCode=4688
Command ExecutionDC0064	WinEventLog:PowerShell	EventCode=4103, 4104, 4105, 4106

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ProcessName	Can be tuned to specific binaries used for service enumeration (e.g., `sc.exe`, `tasklist.exe`).
CommandLineMatch	Filters for variations like `sc query`, `net start`, `Get-Service`.
ParentProcess	Used to suppress known admin scripts or automation jobs.

AN1326 · Linux

Execution of service management commands like systemctl list-units, service --status-all, or direct reading of /etc/init.d.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	auditd:EXECVE	execve

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
CommandPattern	Includes service enumeration commands like `systemctl`, `service`, or custom scripts.
ExecutionUser	Tunable by user context (e.g., root vs. standard user).
TimeWindow	Used for correlation with privilege escalation or lateral movement.

AN1327 · macOS

Discovery via launchctl commands, or process enumeration using ps aux | grep com.apple. to identify daemons and services.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	macos:osquery	process_events
Command ExecutionDC0064	macos:unifiedlog	None

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
CommandLineContent	Tune to recognize `launchctl list`, `launchctl print`, or service grep strings.
ProcessParent	Filter known benign automation or MDM agent invocations.

2 analytics

Certain commands are frequently used by malicious actors and infrequently used by normal users. By looking for execution of these commands in short periods of time, we can not only see when a malicious user was on the system but also get an idea of what they were doing.

TypeTTPCoverageLowSubmitted2013

D3FEND techniques

The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.

ID	Name
D3-PLA	Process Lineage Analysis

Data model references

The CAR data model objects, actions and fields the logic reads. Map these to your own schema before implementing.

Object	Action	Field
process	create	hostname
process	create	ppid
process	create	exe

Implementations

Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.

processes = search Process:Create
reg_processes = filter processes where (exe == "arp.exe" or exe == "at.exe" or exe == "attrib.exe"
 or exe == "cscript.exe" or exe == "dsquery.exe" or exe == "hostname.exe"
 or exe == "ipconfig.exe" or exe == "mimikatz.exe" or exe == "nbstat.exe"
 or exe == "net.exe" or exe == "netsh.exe" or exe == "nslookup.exe"
 or exe == "ping.exe" or exe == "quser.exe" or exe == "qwinsta.exe"
 or exe == "reg.exe" or exe == "runas.exe" or exe == "sc.exe"
 or exe == "schtasks.exe" or exe == "ssh.exe" or exe == "systeminfo.exe"
 or exe == "taskkill.exe" or exe == "telnet.exe" or exe == "tracert.exe"
 or exe == "wscript.exe" or exe == "xcopy.exe")
reg_grouped = group reg by hostname, ppid where(max time between two events is 30 minutes)
output reg_grouped

DNIF version of the above pseudocode.

_fetch * from event where $LogName=WINDOWS-SYSMON AND $EventID=1 AND $App=regex(arp\.exe|at\.exe|attrib\.exe|cscript\.exe|dsquery\.exe|hostname\.exe|ipconfig\.exe|mimikatz.exe|nbstat\.exe|net\.exe|netsh\.exe|nslookup\.exe|ping\.exe|quser\.exe|qwinsta\.exe|reg\.exe|runas\.exe|sc\.exe|schtasks\.exe|ssh\.exe|systeminfo\.exe|taskkill\.exe|telnet\.exe|tracert\.exe|wscript\.exe|xcopy\.exe)i group count_unique $App limit 100
>>_agg count
>>_checkif int_compare Count > 1 include

LogPoint version of the above pseudocode.

norm_id=WindowsSysmon event_id=1 image IN ["*\arp.exe", "*\at.exe", "*\attrib.exe", "*\cscript.exe", "*\dsquery.exe", "*\hostname.exe", "*\ipconfig.exe", "*\mimikatz.exe", "*\nbstat.exe", "*\net.exe", "*\netsh.exe", "*\nslookup.exe", "*\ping.exe", "*\quser.exe", "*\qwinsta.exe", "*\reg.exe", "*\runas.exe", "*\sc.exe", "*\schtasks.exe", "*\ssh.exe", "*\systeminfo.exe", "*\taskkill.exe", "*\telnet.exe", "*\tracert.exe", "*\wscript.exe", "*\xcopy.exe"]
| chart count() as cnt by host
| search cnt > 1

Unit tests

CAR’s own validation procedures for this analytic.

Within a command window, execute several of the commands in quick succession.

["ipconfig /all","hostname","systeminfo","reg.exe Query HKLM\\Software\\Microsoft"]

When entering on a host for the first time, an adversary may try to discover information about the host. There are several built-in Windows commands that can be used to learn about the software configurations, active users, administrators, and networking configuration. These commands should be monitored to identify when an adversary is learning information about the system and environment. The information returned may impact choices an adversary can make when establishing persistence, escalating privileges, or moving laterally.

TypeTTPCoverageModerateSubmitted2016

D3FEND techniques

The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.

ID	Name
D3-PSA	Process Spawn Analysis

Data model references

The CAR data model objects, actions and fields the logic reads. Map these to your own schema before implementing.

Object	Action	Field
process	create	command_line
process	create	exe

Implementations

Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.

To be effective in deciphering malicious and benign activity, the full command line is essential. Similarly, having information about the parent process can help with making decisions and tuning to an environment.

process = search Process:Create
info_command = filter process where (
 exe == "hostname.exe" or
 exe == "ipconfig.exe" or
 exe == "net.exe" or
 exe == "quser.exe" or
 exe == "qwinsta.exe" or
 exe == "sc" and (command_line match " query" or command_line match " qc")) or
 exe == "systeminfo.exe" or
 exe == "tasklist.exe" or
 exe == "whoami.exe"
)
output info_command

Splunk version of the above pseudocode search.

index=__your_sysmon_index__ EventCode=1 (Image="C:\\Windows\\*\\hostname.exe" OR Image="C:\\Windows\\*\\ipconfig.exe" OR Image="C:\\Windows\\*\\net.exe" OR Image="C:\\Windows\\*\\quser.exe" OR Image="C:\\Windows\\*\\qwinsta.exe" OR (Image="C:\\Windows\\*\\sc.exe" AND (CommandLine="* query *" OR CommandLine="* qc *")) OR Image="C:\\Windows\\*\\systeminfo.exe" OR Image="C:\\Windows\\*\\tasklist.exe" OR Image="C:\\Windows\\*\\whoami.exe")|stats values(Image) as "Images" values(CommandLine) as "Command Lines" by ComputerName

EQL version of the above pseudocode search.

process where subtype.create and
  (process_name == "hostname.exe" or process_name == "ipconfig.exe" or process_name == "net.exe" or process_name == "quser.exe" process_name == "qwinsta.exe" or process_name == "systeminfo.exe" or process_name == "tasklist.exe" or process_name == "whoami.exe" or (process_name == "sc.exe" and (command_line == "* query *" or command_line == "* qc *")))

LogPoint version of the above pseudocode.

norm_id=WindowsSysmon event_id=1 (image in ["*\hostname.exe", "*\ipconfig.exe", "*\net.exe", "*\quser.exe", "*\qwinsta.exe", "*\systeminfo.exe", "*\tasklist.exe", "*\whoami.exe"] OR (image="*\sc.exe" command IN ["* query *", "* qc *"))

Tests8Executorscmd 4 · sh 2 · bash 1 · PowerShell 1Need elevation1 of 8Have prerequisites0Have cleanup1Platformswindows, linux, macos

Test

Platform

Executor

Elevation

Prereqs

Cleanup

Ref

System Service Discovery

windows

cmd

Required

—

System Service Discovery - net.exe

windows

cmd

—

Yes

Enumerates started system services using net.exe and writes them to a file. This technique has been used by multiple threat actors. Upon successful execution, net.exe will run from cmd.exe that queries services. Expected output is to a txt file in in the temp directory called service-list.txt.

Input arguments

Name	Type	Default	Description
output_file	path	%temp%\service-list.txt	Path of file to hold net.exe output

Attack command

net.exe start >> #{output_file}

Cleanup command

del /f /q /s #{output_file} >nul 2>&1

GUID144cd552-9d86-4a97-9ee0-6864bbc61840

System Service Discovery - systemctl/service

linux

bash

—

Get-Service Execution

windows

cmd

—

System Service Discovery - macOS launchctl

macos

—

System Service Discovery - Windows Scheduled Tasks (schtasks)

windows

cmd

—

System Service Discovery - Services Registry Enumeration

windows

PowerShell

—

System Service Discovery - Linux init scripts

linux

—

Tests from Atomic Red Team (MIT licence) · technique definition

System Service Discovery detections T1007

13 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

Top 19%of all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs