Applied Cybernetics Group
T1007 System Service Discovery
- Technique
T1007- Tactics
- Discovery
- Research, 90 days
- 1
- KEV CVEs mapped
- 1
- SigmaHQ rules
- 11
- Elastic, Splunk
- 6
- thrunt rules
- 0
- Upstream
- https://attack.mitre.org/techniques/T1007
MITRE description
Adversaries may try to gather information about registered local system services. Adversaries may obtain information about services using tools as well as OS utility commands such as <code>sc query</code>, <code>tasklist /svc</code>, <code>systemctl --type=service</code>, and <code>net start</code>. Adversaries may also gather information about schedule tasks via commands such as `schtasks` on Windows or `crontab -l` on Linux and macOS.(Citation: Elastic Security Labs GOSAR 2024)(Citation: SentinelLabs macOS Malware 2021)(Citation: Splunk Linux Gormir 2024)(Citation: Aquasec Kinsing 2020) Adversaries may use the information from [System Service Discovery](https://attack.mitre.org/techniques/T1007) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
KEV CVEs mapped to this technique
MITRE CTID maps these KEV CVEs to this technique by hand. They are the actively exploited vulnerabilities behind this technique's KEV signal.
Research citing this technique
Reports and advisories from the last 90 days that cite this technique.
-
2026-10-22Group-IB: Inside SiriusQT: A Seriously Skilled RAT
Detection coverage
SigmaHQ community rules
- Potential Registry Reconnaissance Via PowerShell Script (threat-hunting)
- Net.EXE Execution (threat-hunting)
- SC.EXE Query Execution (threat-hunting)
- Crontab Enumeration (core)
- ESXi Network Configuration Discovery Via ESXCLI (core)
- ESXi Storage Information Discovery Via ESXCLI (core)
- ESXi System Information Discovery Via ESXCLI (core)
- ESXi VM List Discovery Via ESXCLI (core)
- ESXi VSAN Information Discovery Via ESXCLI (core)
- HackTool - PCHunter Execution (core)
- Potential Configuration And Service Reconnaissance Via Reg.EXE (core)
Elastic and Splunk rules
- PowerShell Suspicious Discovery Related Windows API Functions (elastic)
- Enumeration Command Spawned via WMIPrvSE (elastic)
- Deprecated - PowerShell Script with Discovery Capabilities (elastic)
- System Service Discovery through built-in Windows Utilities (elastic)
- Windows Net System Service Discovery (splunk)
- Windows WinPEAS PowerShell Script Execution (splunk)