cyberstrikeus T1007 System Service Discovery
High-Level Description
Adversaries may try to gather information about registered local system services. Adversaries may obtain information about services using tools as well as OS utility commands such as sc query, tasklist /svc, systemctl --type=service, and net start. Adversaries may also gather information about schedule tasks via commands such as schtasks on Windows or crontab -l on Linux and macOS.
Adversaries may use the information from System Service Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Kill Chain Phase
- Discovery (TA0007)
Platforms: Linux, macOS, Windows
What to Check
- Identify if System Service Discovery technique is applicable to target environment
- Check Linux systems for indicators of System Service Discovery
- Check macOS systems for indicators of System Service Discovery
- Check Windows systems for indicators of System Service Discovery
- Assess detection coverage (1 detection strategies)
How to Test
Atomic Red Team Tests
The following tests are from Atomic Red Team and provide actionable ways to test this technique:
Atomic Test 1: System Service Discovery
Identify system services.
Upon successful execution, cmd.exe will execute service commands with expected result to stdout.
Supported Platforms: windows Elevation Required: Yes
tasklist.exe /svc
sc query
sc query state= all
Atomic Test 2: System Service Discovery - net.exe
Enumerates started system services using net.exe and writes them to a file. This technique has been used by multiple threat actors.
Upon successful execution, net.exe will run from cmd.exe that queries services. Expected output is to a txt file in in the temp directory called service-list.txt.
Supported Platforms: windows
net.exe start >> #{output_file}
Atomic Test 3: System Service Discovery - systemctl/service
Enumerates system service using systemctl/service
Supported Platforms: linux
if [ "$(uname)" = 'FreeBSD' ]; then service -e; else systemctl --type=service; fi;
Atomic Test 4: Get-Service Execution
Executes the Get-Service cmdlet to gather objects representing all services on the local system.
Supported Platforms: windows
powershell.exe Get-Service
Atomic Test 5: System Service Discovery - macOS launchctl
Enumerates services on macOS using launchctl. Used by adversaries for identifying daemons, background services, and persistence mechanisms.
Supported Platforms: macos
launchctl list
Manual Testing
If Atomic Red Team tests are not applicable, manually verify the technique by:
Identify Attack Surface: Determine if the target environment is susceptible to System Service Discovery by examining the target platforms (Linux, macOS, Windows).
Assess Existing Defenses: Review whether mitigations for T1007 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.
Remediation Guide
No specific mitigations documented for this technique.
Detection
Detection of System Service Discovery Commands Across OS Platforms
Risk Assessment
| Finding | Severity | Impact |
|---|---|---|
| System Service Discovery technique applicable | Medium | Discovery |
CWE Categories
| CWE ID | Title |
|---|---|
| CWE-200 | Exposure of Sensitive Information |