T1007 · System Service Discovery

Sunturai

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice

T1007 · System Service Discovery · Sunturai

attack-patternenterprise-attackT1007

System Service Discovery

attack-pattern--322bad5a-1c49-4d23-ab79-76d641794afa

Adversaries may try to gather information about registered local system services. Adversaries may obtain information about services using tools as well as OS utility commands such as sc query, tasklist /svc, systemctl --type=service, and net start. Adversaries may also gather information about schedule tasks via commands such as `schtasks` on Windows or `crontab -l` on Linux and macOS.(Citation: Elastic Security Labs GOSAR 2024) (Citation: SentinelLabs macOS Malware 2021) (Citation: Splunk Linux Gormir 2024) (Citation: Aquasec Kinsing 2020) Adversaries may use the information from System Service Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.

Created: May 31, 2017, 9:30 PM UTC
Modified: May 12, 2026, 3:12 PM UTC

12 published detections cover this technique

Every one carries the source it came from and the licence it was published under.

Detections covering this technique
Detection	Severity	Source	Published	Licence
Windows Net System Service Discovery	Medium	Splunk security content	Oct 13, 2026	Apache License 2.0
Enumeration Command Spawned via WMIPrvSE	Low	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
PowerShell Suspicious Discovery Related Windows API Functions	Low	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Windows WinPEAS PowerShell Script Execution	Medium	Splunk security content	Aug 26, 2026	Apache License 2.0
Potential Configuration And Service Reconnaissance Via Reg.EXE	Medium	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
HackTool - PCHunter Execution	High	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
ESXi VSAN Information Discovery Via ESXCLI	Medium	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
ESXi VM List Discovery Via ESXCLI	Medium	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
ESXi System Information Discovery Via ESXCLI	Medium	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
ESXi Storage Information Discovery Via ESXCLI	Medium	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
ESXi Network Configuration Discovery Via ESXCLI	Medium	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
Crontab Enumeration	Low	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1

Showing 12 of 12

Filter in the catalogue

External references

mitre-attackT1007Open reference

Aquasec Kinsing 2020Open reference

Elastic Security Labs GOSAR 2024Open reference

SentinelLabs macOS Malware 2021Open reference

Splunk Linux Gormir 2024Open reference

Platforms

LinuxmacOSWindows

Kill chain phases

discovery

Relationships

Incoming and outgoing edges in the selected ATT&CK release.

Incoming and outgoing edges in the selected ATT&CK release
Direction	Type	Related object