tfMITRE ATT&CK technique

System Service Discovery T1007

Tactic: Discovery
Platforms: Linux, macOS, Windows
Version: 1.6
Created: 31 May 2017
Last modified: 12 May 2026
Contributor: Harshal Tupsamudre, Qualys

Adversaries may try to gather information about registered local system services. Adversaries may obtain information about services using tools as well as OS utility commands such as sc query, tasklist /svc, systemctl --type=service, and net start. Adversaries may also gather information about schedule tasks via commands such as schtasks on Windows or crontab -l on Linux and macOS.[1][2][3][4]

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsTop 12%

Threat groups88th percentile · 87% of ATT&CK techniques have fewer threat groups attributed.

CampaignsTop 17%

Campaigns83rd percentile · 73% of ATT&CK techniques have fewer campaigns recorded.

Tools & malwareTop 7%

Tools & malware93rd percentile · 93% of ATT&CK techniques have fewer tools implementing them.

Detection rulesTop 19%

Detection rules81st percentile · 79% of ATT&CK techniques have fewer detection rules written.

tfMITRE ATT&CK technique

System Service Discovery T1007

Tactic: Discovery
Platforms: Linux, macOS, Windows
Version: 1.6
Created: 31 May 2017
Last modified: 12 May 2026
Contributor: Harshal Tupsamudre, Qualys

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsTop 12%

Threat groups88th percentile · 87% of ATT&CK techniques have fewer threat groups attributed.

CampaignsTop 17%

Campaigns83rd percentile · 73% of ATT&CK techniques have fewer campaigns recorded.

Tools & malwareTop 7%

Tools & malware93rd percentile · 93% of ATT&CK techniques have fewer tools implementing them.

Detection rulesTop 19%

Detection rules81st percentile · 79% of ATT&CK techniques have fewer detection rules written.

System Service Discovery MITRE reference T1007

Top 12%of all ATT&CK techniques for number of groups

15 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

MirrorFaceG1054 ↗

Has used Tasklist for discovery post compromise.1

created 2026-04-171 referenceaka Earth Kasha

Volt TyphoonG1017 ↗

Has used net start to list running services.1

created 2023-07-271 referenceaka BRONZE SILHOUETTE

Earth LuscaG1006 ↗

Has used Tasklist to obtain information from a compromised host.1

created 2022-07-011 referenceaka TAG-22

Aquatic PandaG0143 ↗

Has attempted to discover services for third party EDR products.1

created 2022-01-181 reference

TeamTNTG0139 ↗

Has searched for services such as Alibaba Cloud Security's aliyun service and BMC Helix Cloud Security's bmc-agent service in order to disable them.1

created 2021-10-011 reference

Indrik SpiderG0119 ↗

Has used the win32_service WMI class to retrieve a list of services from the system.1

created 2021-01-061 referenceaka Evil Corp

All 15 groups for this technique · 6 newest in this preview

2 campaigns have been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.

Operation CuckooBeesC0012 ↗

During Operation CuckooBees, the threat actors used the net start command as part of their initial reconnaissance.1

2019–2022

Operation WocaoC0014 ↗

During Operation Wocao, threat actors used the tasklist command to search for one of its backdoors.1

2017–2019

All 2 campaigns for this technique

52 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.

LAMEHUGS9035 ↗

Can gather service information on targeted systems.1 2

created 2026-04-21MALWAREcarried by 1 group

EmbargoS1247 ↗

Has obtained active services running on the victim’s system through the functions OpenSCManagerW() and EnumServicesStatusExW().1

created 2025-10-19MALWAREcarried by 1 group

Medusa RansomwareS1244 ↗

Has leveraged an encoded list of services that it designates for termination.1 2 3

created 2025-10-17MALWAREcarried by 1 group

QilinS1242 ↗

Can identify specific services for termination or to be left running at execution.1 2 3 4

created 2025-09-26MALWAREcarried by 2 groups

PUBLOADS1228 ↗

Has leveraged tasklist to gather running services on victim host.1

created 2025-08-04MALWAREcarried by 1 group

SardonicS1085 ↗

Has the ability to execute the net start command.1

created 2023-09-05MALWAREcarried by 1 group

All 52 software entries for this technique · 6 newest in this preview

Data component	Name	Channel
Process CreationDC0032	WinEventLog:Security	EventCode=4688
Command ExecutionDC0064	WinEventLog:PowerShell	EventCode=4103, 4104, 4105, 4106

Field	What you tune
ProcessName	Can be tuned to specific binaries used for service enumeration (e.g., `sc.exe`, `tasklist.exe`).
CommandLineMatch	Filters for variations like `sc query`, `net start`, `Get-Service`.
ParentProcess	Used to suppress known admin scripts or automation jobs.

Field	What you tune
CommandPattern	Includes service enumeration commands like `systemctl`, `service`, or custom scripts.
ExecutionUser	Tunable by user context (e.g., root vs. standard user).
TimeWindow	Used for correlation with privilege escalation or lateral movement.

Data component	Name	Channel
Process CreationDC0032	macos:osquery	process_events
Command ExecutionDC0064	macos:unifiedlog	—

Field	What you tune
CommandLineContent	Tune to recognize `launchctl list`, `launchctl print`, or service grep strings.
ProcessParent	Filter known benign automation or MDM agent invocations.

System Service Discovery T1007

System Service Discovery T1007

System Service Discovery MITRE reference T1007

System Service Discovery MITRE reference T1007

Offense vs defense T1007

System Service Discovery detection strategy DET0483

Detection of System Service Discovery Commands Across OS Platforms

Log sources

Tunable fields

Log sources

Tunable fields

Log sources

Tunable fields

D3FEND techniques

Data model references

Implementations

Unit tests

D3FEND techniques

Data model references

Implementations

System Service Discovery detections T1007

System Service Discovery detections T1007