t1007-system-service-discovery

name	T1007_system-service-discovery
description	Adversaries may try to gather information about registered local system services.
category	information-gathering
version	18.1
author	cyberstrike-official
tags	["mitre-attack","enterprise","t1007","discovery","linux","macos","windows"]
technique_id	T1007
tactic	discovery
all_tactics	["discovery"]
platforms	["Linux","macOS","Windows"]
mitre_url	https://attack.mitre.org/techniques/T1007
tech_stack	["linux","macos","windows"]
cwe_ids	["CWE-200"]
chains_with	[]
prerequisites	[]
severity_boost	{}

T1007 System Service Discovery

High-Level Description

Adversaries may try to gather information about registered local system services. Adversaries may obtain information about services using tools as well as OS utility commands such as sc query, tasklist /svc, systemctl --type=service, and net start. Adversaries may also gather information about schedule tasks via commands such as schtasks on Windows or crontab -l on Linux and macOS.

Adversaries may use the information from System Service Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.

Kill Chain Phase

• Discovery (TA0007)

Platforms: Linux, macOS, Windows

What to Check

• Identify if System Service Discovery technique is applicable to target environment
• Check Linux systems for indicators of System Service Discovery
• Check macOS systems for indicators of System Service Discovery
• Check Windows systems for indicators of System Service Discovery
• Assess detection coverage (1 detection strategies)

How to Test

Atomic Red Team Tests

The following tests are from Atomic Red Team and provide actionable ways to test this technique:

Atomic Test 1: System Service Discovery

Identify system services.

Upon successful execution, cmd.exe will execute service commands with expected result to stdout.

Supported Platforms: windows Elevation Required: Yes

tasklist.exe /svc
sc query
sc query state= all

Atomic Test 2: System Service Discovery - net.exe

Enumerates started system services using net.exe and writes them to a file. This technique has been used by multiple threat actors.

Upon successful execution, net.exe will run from cmd.exe that queries services. Expected output is to a txt file in in the temp directory called service-list.txt.

Supported Platforms: windows

net.exe start >> #{output_file}