{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1007","id":"T1007","name":"System Service Discovery","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1007","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"42f9cb3ee1b63eab0494e71a1a0b7def620bc040b4ab293047526c8e18f3568a","description":"Adversaries may try to gather information about registered local system services. Adversaries may obtain information about services using tools as well as OS utility commands such as <code>sc query</code>, <code>tasklist /svc</code>, <code>systemctl --type=service</code>, and <code>net start</code>. Adversaries may also gather information about schedule tasks via commands such as `schtasks` on Windows or `crontab -l` on Linux and macOS.(Citation: Elastic Security Labs GOSAR 2024)(Citation: SentinelLabs macOS Malware 2021)(Citation: Splunk Linux Gormir 2024)(Citation: Aquasec Kinsing 2020)\n\nAdversaries may use the information from [System Service Discovery](https://attack.mitre.org/techniques/T1007) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1007","external_id":"T1007"},{"source_name":"Aquasec Kinsing 2020","description":"Gal Singer. (2020, April 3). Threat Alert: Kinsing Malware Attacks Targeting Container Environments. Retrieved May 22, 2025.","url":"https://www.aquasec.com/blog/threat-alert-kinsing-malware-container-vulnerability/"},{"source_name":"Elastic Security Labs GOSAR 2024","description":"Jia Yu Chan, Salim Bitam, Daniel Stepanic, and Seth Goodwin. (2024, December 12). Under the SADBRIDGE with GOSAR: QUASAR Gets a Golang Rewrite. Retrieved May 22, 2025.","url":"https://www.elastic.co/security-labs/under-the-sadbridge-with-gosar"},{"source_name":"SentinelLabs macOS Malware 2021","description":"Phil Stokes. (2021, February 16). 20 Common Tools & Techniques Used by macOS Threat Actors & Malware. Retrieved May 22, 2025.","url":"https://www.sentinelone.com/labs/20-common-tools-techniques-used-by-macos-threat-actors-malware/"},{"source_name":"Splunk Linux Gormir 2024","description":"Splunk Threat Research Team , Teoderick Contreras. (2024, July 15). Breaking Down Linux.Gomir: Understanding this Backdoor’s TTPs. Retrieved May 22, 2025.","url":"https://www.splunk.com/en_us/blog/security/breaking-down-linux-gomir-understanding-this-backdoors-ttps.html"}],"platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[],"telemetry":[{"id":"DC0064","name":"Command Execution","page":"telemetry/DC0064/","kind":"attack_component","category":"Script and command execution","description":"Execution of a command and its interpreter or parent context.","collection_focus":"Collect process command lines and relevant shell/interpreter audit; shell history alone is neither complete nor tamper-resistant.","providers":[{"name":"PowerShell Script Block Logging","scope":"Script content via event 4104 when configured; channel depends on PowerShell edition.","source_id":"powershell"},{"name":"Sysmon process events","scope":"Interpreter launch and parent context, not full script content.","source_id":"sysmon"},{"name":"Linux Audit","scope":"execve-family execution context; shell built-ins need additional instrumentation.","source_id":"linux"}],"configuration":["Enable Script Block Logging through the policy/configuration for the installed edition. Forward Microsoft-Windows-PowerShell/Operational for Windows PowerShell, or PowerShellCore/Operational for PowerShell 7.","Retain script-block ID and fragment ordering alongside process creation. Protect access to collected script text; secrets may be included.","On Linux, use narrowly scoped Audit execution rules for the lab account and supported architectures, and retain joined SYSCALL/EXECVE/PATH records."],"configuration_example":null,"required_fields":["interpreter","command_line","actor_uid","session_id"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0064","collector":"illustrative-lab-collector","observation":{"interpreter":"/bin/sh","command_line":"printf LAB_TELEMETRY_CHECK","actor_uid":1000,"session_id":"lab-session-1"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Script content and process command lines are different signals. Logging may be partial, fragmented, filtered or disabled; never assume a command line reveals everything executed.","sources":[{"id":"powershell","title":"Microsoft PowerShell logging on Windows","url":"https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_logging_windows?view=powershell-7.5"},{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"}],"association":"attack_component","anomaly_design":"Per host role and principal: rare interpreters, command argument patterns and parent-child sequences. Normalize scripts carefully; obfuscation, administrative automation and missing command lines change visibility."},{"id":"DC0032","name":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component","category":"Endpoint activity","description":"Creation of a process with executable, command line, parent and security context.","collection_focus":"Collect Sysmon ProcessCreate (1); preserve ProcessGuid and parent identifiers. Security 4688 is an alternative with separate audit/command-line settings.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":{"label":"Sysmon filter fragment · merge into the reviewed lab configuration","language":"xml","source_id":"sysmon_config","content":"<EventFiltering>\n  <ProcessCreate onmatch=\"include\">\n    <Image condition=\"is\">C:\\Windows\\System32\\whoami.exe</Image>\n  </ProcessCreate>\n</EventFiltering>","note":"This fragment only selects the named process. It is not a complete production policy. Inspect the installed schema with sysmon64 -s; preserve existing rules, then apply the reviewed complete configuration with sysmon64 -c <configuration-file>."},"required_fields":["process_guid","image","parent_image","command_line","user"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."}],"detection":{"key":"enterprise/T1007","id":"T1007","name":"System Service Discovery","domain":"enterprise","platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"source_url":"https://attack.mitre.org/techniques/T1007","technique_page":"techniques/enterprise/T1007/","page":"detections/enterprise/T1007/","status":"rule_source_available","counts":{"sigma":8,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"sigma_rules":[{"id":"403ed92c-b7ec-4edd-9947-5b535ee12d46","title":"Crontab Enumeration","status":"test","level":"low","logsource":{"product":"linux","category":"process_creation"},"data_path":"data/detection-rules/403ed92c-b7ec-4edd-9947-5b535ee12d46.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/process_creation/proc_creation_lnx_crontab_enumeration.yml","author":"Joseliyo Sanchez, @Joseliyo_Jstnk","kind":"sigma"},{"id":"33e814e0-1f00-4e43-9c34-31fb7ae2b174","title":"ESXi Network Configuration Discovery Via ESXCLI","status":"test","level":"medium","logsource":{"category":"process_creation","product":"linux"},"data_path":"data/detection-rules/33e814e0-1f00-4e43-9c34-31fb7ae2b174.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/process_creation/proc_creation_lnx_esxcli_network_discovery.yml","author":"Cedric Maurugeon","kind":"sigma"},{"id":"f41dada5-3f56-4232-8503-3fb7f9cf2d60","title":"ESXi Storage Information Discovery Via ESXCLI","status":"test","level":"medium","logsource":{"category":"process_creation","product":"linux"},"data_path":"data/detection-rules/f41dada5-3f56-4232-8503-3fb7f9cf2d60.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/process_creation/proc_creation_lnx_esxcli_storage_discovery.yml","author":"Nasreddine Bencherchali (Nextron Systems), Cedric Maurugeon","kind":"sigma"},{"id":"e80273e1-9faf-40bc-bd85-dbaff104c4e9","title":"ESXi System Information Discovery Via ESXCLI","status":"test","level":"medium","logsource":{"category":"process_creation","product":"linux"},"data_path":"data/detection-rules/e80273e1-9faf-40bc-bd85-dbaff104c4e9.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/process_creation/proc_creation_lnx_esxcli_system_discovery.yml","author":"Cedric Maurugeon","kind":"sigma"},{"id":"5f1573a7-363b-4114-9208-ad7a61de46eb","title":"ESXi VM List Discovery Via ESXCLI","status":"test","level":"medium","logsource":{"category":"process_creation","product":"linux"},"data_path":"data/detection-rules/5f1573a7-363b-4114-9208-ad7a61de46eb.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/process_creation/proc_creation_lnx_esxcli_vm_discovery.yml","author":"Cedric Maurugeon","kind":"sigma"},{"id":"d54c2f06-aca9-4e2b-81c9-5317858f4b79","title":"ESXi VSAN Information Discovery Via ESXCLI","status":"test","level":"medium","logsource":{"category":"process_creation","product":"linux"},"data_path":"data/detection-rules/d54c2f06-aca9-4e2b-81c9-5317858f4b79.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/process_creation/proc_creation_lnx_esxcli_vsan_discovery.yml","author":"Nasreddine Bencherchali (Nextron Systems), Cedric Maurugeon","kind":"sigma"},{"id":"fca949cc-79ca-446e-8064-01aa7e52ece5","title":"HackTool - PCHunter Execution","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/fca949cc-79ca-446e-8064-01aa7e52ece5.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_hktl_pchunter.yml","author":"Florian Roth (Nextron Systems), Nasreddine Bencherchali","kind":"sigma"},{"id":"970007b7-ce32-49d0-a4a4-fbef016950bd","title":"Potential Configuration And Service Reconnaissance Via Reg.EXE","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/970007b7-ce32-49d0-a4a4-fbef016950bd.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_reg_query_registry.yml","author":"Timur Zinniatullin, oscd.community","kind":"sigma"}],"atlas_basic":[],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0483","name":"Detection of System Service Discovery Commands Across OS Platforms","url":"https://attack.mitre.org/detectionstrategies/DET0483","stix_id":"x-mitre-detection-strategy--d8e8768e-34c1-45f4-95d2-fa7ba317b63a","relationship_id":"relationship--e3fe4c82-6100-4f69-8895-c11bc8d53e8d","description":"","analytics":[{"id":"AN1325","name":"Analytic 1325","guidance":"Enumeration of services via native CLI tools (e.g., `sc query`, `tasklist /svc`, `net start`) or API calls via PowerShell and WMI.","url":"https://attack.mitre.org/detectionstrategies/DET0483#AN1325","platforms":["Windows"],"tuning":[{"field":"ProcessName","description":"Can be tuned to specific binaries used for service enumeration (e.g., `sc.exe`, `tasklist.exe`)."},{"field":"CommandLineMatch","description":"Filters for variations like `sc query`, `net start`, `Get-Service`."},{"field":"ParentProcess","description":"Used to suppress known admin scripts or automation jobs."}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"WinEventLog:Security","channel":"EventCode=4688","platforms":["Windows"],"analytic_id":"AN1325","source_url":"https://attack.mitre.org/detectionstrategies/DET0483#AN1325","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0064","component":"Command Execution","name":"WinEventLog:PowerShell","channel":"EventCode=4103, 4104, 4105, 4106","platforms":["Windows"],"analytic_id":"AN1325","source_url":"https://attack.mitre.org/detectionstrategies/DET0483#AN1325","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0064/"}]},{"id":"AN1326","name":"Analytic 1326","guidance":"Execution of service management commands like `systemctl list-units`, `service --status-all`, or direct reading of `/etc/init.d`.","url":"https://attack.mitre.org/detectionstrategies/DET0483#AN1326","platforms":["Linux"],"tuning":[{"field":"CommandPattern","description":"Includes service enumeration commands like `systemctl`, `service`, or custom scripts."},{"field":"ExecutionUser","description":"Tunable by user context (e.g., root vs. standard user)."},{"field":"TimeWindow","description":"Used for correlation with privilege escalation or lateral movement."}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"auditd:EXECVE","channel":"execve","platforms":["Linux"],"analytic_id":"AN1326","source_url":"https://attack.mitre.org/detectionstrategies/DET0483#AN1326","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"}]},{"id":"AN1327","name":"Analytic 1327","guidance":"Discovery via launchctl commands, or process enumeration using `ps aux | grep com.apple.` to identify daemons and services.","url":"https://attack.mitre.org/detectionstrategies/DET0483#AN1327","platforms":["macOS"],"tuning":[{"field":"CommandLineContent","description":"Tune to recognize `launchctl list`, `launchctl print`, or service grep strings."},{"field":"ProcessParent","description":"Filter known benign automation or MDM agent invocations."}],"log_sources":[{"component_id":"DC0064","component":"Command Execution","name":"macos:unifiedlog","channel":"None","platforms":["macOS"],"analytic_id":"AN1327","source_url":"https://attack.mitre.org/detectionstrategies/DET0483#AN1327","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0064/"},{"component_id":"DC0032","component":"Process Creation","name":"macos:osquery","channel":"process_events","platforms":["macOS"],"analytic_id":"AN1327","source_url":"https://attack.mitre.org/detectionstrategies/DET0483#AN1327","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"}]}]}],"telemetry_references":[{"id":"DC0064","name":"Command Execution","tag":"Command Execution","page":"telemetry/DC0064/","kind":"attack_component"},{"id":"DC0032","name":"Process Creation","tag":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[{"id":"S0154","name":"Cobalt Strike","page":"tools/S0154/","kind":"selected_framework","bases":["attack_uses"],"guides":[]},{"id":"S0039","name":"Net","page":"tools/S0039/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0378","name":"PoshC2","page":"tools/S0378/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0692","name":"SILENTTRINITY","page":"tools/S0692/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0057","name":"Tasklist","page":"tools/S0057/","kind":"attack_tool","bases":["attack_uses"],"guides":[]}],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[{"id":"S0154","name":"Cobalt Strike","page":"tools/S0154/","kind":"selected_framework","bases":["attack_uses"],"guides":[]},{"id":"S0039","name":"Net","page":"tools/S0039/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0378","name":"PoshC2","page":"tools/S0378/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0692","name":"SILENTTRINITY","page":"tools/S0692/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0057","name":"Tasklist","page":"tools/S0057/","kind":"attack_tool","bases":["attack_uses"],"guides":[]}],"software":[{"id":"S0015","name":"Ixeshe","url":"https://attack.mitre.org/software/S0015","kind":"malware","description":"[Ixeshe](https://attack.mitre.org/software/S0015) can list running services.(Citation: Trend Micro IXESHE 2012)","relationship_id":"relationship--bedf5d77-af37-4a10-b4d7-3555a9ea2938","references":[{"source_name":"Trend Micro IXESHE 2012","description":"Sancho, D., et al. (2012, May 22). IXESHE An APT Campaign. Retrieved June 7, 2019.","url":"https://www.trendmicro.de/cloud-content/us/pdfs/security-intelligence/white-papers/wp_ixeshe.pdf"}]},{"id":"S0018","name":"Sykipot","url":"https://attack.mitre.org/software/S0018","kind":"malware","description":"[Sykipot](https://attack.mitre.org/software/S0018) may use <code>net start</code> to display running services.(Citation: AlienVault Sykipot 2011)","relationship_id":"relationship--09c10778-19ad-441a-8a75-a3cf1288f960","references":[{"source_name":"AlienVault Sykipot 2011","description":"Blasco, J. (2011, December 12). Another Sykipot sample likely targeting US federal agencies. Retrieved March 28, 2016.","url":"https://www.alienvault.com/open-threat-exchange/blog/another-sykipot-sample-likely-targeting-us-federal-agencies"}]},{"id":"S0024","name":"Dyre","url":"https://attack.mitre.org/software/S0024","kind":"malware","description":"[Dyre](https://attack.mitre.org/software/S0024) has the ability to identify running services on a compromised host.(Citation: Malwarebytes Dyreza November 2015)","relationship_id":"relationship--f79947b2-49bc-4658-b93c-3aa9dbf9cd5e","references":[{"source_name":"Malwarebytes Dyreza November 2015","description":"hasherezade. (2015, November 4). A Technical Look At Dyreza. Retrieved June 15, 2020.","url":"https://blog.malwarebytes.com/threat-analysis/2015/11/a-technical-look-at-dyreza/"}]},{"id":"S0039","name":"Net","url":"https://attack.mitre.org/software/S0039","kind":"tool","description":"The <code>net start</code> command can be used in [Net](https://attack.mitre.org/software/S0039) to find information about Windows services.(Citation: Savill 1999)","relationship_id":"relationship--1d36c3e8-238f-46c6-9b20-9fb4cb5c75ba","references":[{"source_name":"Savill 1999","description":"Savill, J. (1999, March 4). Net.exe reference. Retrieved September 22, 2015.","url":"https://web.archive.org/web/20150511162820/http://windowsitpro.com/windows/netexe-reference"}]},{"id":"S0049","name":"GeminiDuke","url":"https://attack.mitre.org/software/S0049","kind":"malware","description":"[GeminiDuke](https://attack.mitre.org/software/S0049) collects information on programs and services on the victim that are configured to automatically run at startup.(Citation: F-Secure The Dukes)","relationship_id":"relationship--ae9befd5-d8b7-4492-9b47-422a40d610cc","references":[{"source_name":"F-Secure The Dukes","description":"F-Secure Labs. (2015, September 17). The Dukes: 7 years of Russian cyberespionage. Retrieved December 10, 2015.","url":"https://www.f-secure.com/documents/996508/1030745/dukes_whitepaper.pdf"}]},{"id":"S0057","name":"Tasklist","url":"https://attack.mitre.org/software/S0057","kind":"tool","description":"[Tasklist](https://attack.mitre.org/software/S0057) can be used to discover services running on a system.(Citation: Microsoft Tasklist)","relationship_id":"relationship--40c5a024-37db-478b-b90f-27f184bf8f60","references":[{"source_name":"Microsoft Tasklist","description":"Microsoft. (n.d.). Tasklist. Retrieved December 23, 2015.","url":"https://technet.microsoft.com/en-us/library/bb491010.aspx"}]},{"id":"S0081","name":"Elise","url":"https://attack.mitre.org/software/S0081","kind":"malware","description":"[Elise](https://attack.mitre.org/software/S0081) executes <code>net start</code> after initial communication is made to the remote server.(Citation: Lotus Blossom Jun 2015)","relationship_id":"relationship--2a7d01e9-9c42-4d17-947a-629ca7a9d515","references":[{"source_name":"Lotus Blossom Jun 2015","description":"Falcone, R., et al.. (2015, June 16). Operation Lotus Blossom. Retrieved February 15, 2016.","url":"https://www.paloaltonetworks.com/resources/research/unit42-operation-lotus-blossom.html"}]},{"id":"S0082","name":"Emissary","url":"https://attack.mitre.org/software/S0082","kind":"malware","description":"[Emissary](https://attack.mitre.org/software/S0082) has the capability to execute the command <code>net start</code> to interact with services.(Citation: Emissary Trojan Feb 2016)","relationship_id":"relationship--bae7f2fb-99d8-4acf-b61e-f37a215aa82e","references":[{"source_name":"Emissary Trojan Feb 2016","description":"Falcone, R. and Miller-Osborn, J. (2016, February 3). Emissary Trojan Changelog: Did Operation Lotus Blossom Cause It to Evolve?. Retrieved February 15, 2016.","url":"http://researchcenter.paloaltonetworks.com/2016/02/emissary-trojan-changelog-did-operation-lotus-blossom-cause-it-to-evolve/"}]},{"id":"S0085","name":"S-Type","url":"https://attack.mitre.org/software/S0085","kind":"malware","description":"[S-Type](https://attack.mitre.org/software/S0085) runs the command <code>net start</code> on a victim.(Citation: Cylance Dust Storm)","relationship_id":"relationship--abee00d3-8417-468b-84a4-40c7d0ac4f7d","references":[{"source_name":"Cylance Dust Storm","description":"Gross, J. (2016, February 23). Operation Dust Storm. Retrieved December 22, 2021.","url":"https://s7d2.scene7.com/is/content/cylance/prod/cylance-web/en-us/resources/knowledge-center/resource-library/reports/Op_Dust_Storm_Report.pdf"}]},{"id":"S0086","name":"ZLib","url":"https://attack.mitre.org/software/S0086","kind":"malware","description":"[ZLib](https://attack.mitre.org/software/S0086) has the ability to discover and manipulate Windows services.(Citation: Cylance Dust Storm)","relationship_id":"relationship--b7601a08-a52d-4daa-acb9-2f5e3392b6c3","references":[{"source_name":"Cylance Dust Storm","description":"Gross, J. (2016, February 23). Operation Dust Storm. Retrieved December 22, 2021.","url":"https://s7d2.scene7.com/is/content/cylance/prod/cylance-web/en-us/resources/knowledge-center/resource-library/reports/Op_Dust_Storm_Report.pdf"}]},{"id":"S0091","name":"Epic","url":"https://attack.mitre.org/software/S0091","kind":"malware","description":"[Epic](https://attack.mitre.org/software/S0091) uses the <code>tasklist /svc</code> command to list the services on the system.(Citation: Kaspersky Turla)","relationship_id":"relationship--d012dd66-fef4-4714-bb00-55d9dd2861a1","references":[{"source_name":"Kaspersky Turla","description":"Kaspersky Lab's Global Research and Analysis Team. (2014, August 7). The Epic Turla Operation: Solving some of the mysteries of Snake/Uroburos. Retrieved December 11, 2014.","url":"https://securelist.com/the-epic-turla-operation/65545/"}]},{"id":"S0127","name":"BBSRAT","url":"https://attack.mitre.org/software/S0127","kind":"malware","description":"[BBSRAT](https://attack.mitre.org/software/S0127) can query service configuration information.(Citation: Palo Alto Networks BBSRAT)","relationship_id":"relationship--54e99ba2-143f-43be-8d7f-79de5551d1ac","references":[{"source_name":"Palo Alto Networks BBSRAT","description":"Lee, B. Grunzweig, J. (2015, December 22). BBSRAT Attacks Targeting Russian Organizations Linked to Roaming Tiger. Retrieved August 19, 2016.","url":"http://researchcenter.paloaltonetworks.com/2015/12/bbsrat-attacks-targeting-russian-organizations-linked-to-roaming-tiger/"}]},{"id":"S0154","name":"Cobalt Strike","url":"https://attack.mitre.org/software/S0154","kind":"malware","description":"[Cobalt Strike](https://attack.mitre.org/software/S0154) can enumerate services on compromised hosts.(Citation: Cobalt Strike Manual 4.3 November 2020)","relationship_id":"relationship--6017ff5f-e522-45fe-857a-e4fef38a6349","references":[{"source_name":"Cobalt Strike Manual 4.3 November 2020","description":"Strategic Cyber LLC. (2020, November 5). Cobalt Strike: Advanced Threat Tactics for Penetration Testers. Retrieved April 13, 2021.","url":"https://web.archive.org/web/20210708035426/https://www.cobaltstrike.com/downloads/csmanual43.pdf"}]},{"id":"S0180","name":"Volgmer","url":"https://attack.mitre.org/software/S0180","kind":"malware","description":"[Volgmer](https://attack.mitre.org/software/S0180) queries the system to identify existing services.(Citation: US-CERT Volgmer Nov 2017)","relationship_id":"relationship--6139509a-709b-4ef4-81fb-25b9a35e2c60","references":[{"source_name":"US-CERT Volgmer Nov 2017","description":"US-CERT. (2017, November 22). Alert (TA17-318B): HIDDEN COBRA – North Korean Trojan: Volgmer. Retrieved December 7, 2017.","url":"https://www.us-cert.gov/ncas/alerts/TA17-318B"}]},{"id":"S0201","name":"JPIN","url":"https://attack.mitre.org/software/S0201","kind":"malware","description":"[JPIN](https://attack.mitre.org/software/S0201) can list running services.(Citation: Microsoft PLATINUM April 2016)","relationship_id":"relationship--de525077-129a-4d14-8419-6a3d219710a8","references":[{"source_name":"Microsoft PLATINUM April 2016","description":"Windows Defender Advanced Threat Hunting Team. (2016, April 29). PLATINUM: Targeted attacks in South and Southeast Asia. Retrieved February 15, 2018.","url":"https://download.microsoft.com/download/2/2/5/225BFE3E-E1DE-4F5B-A77B-71200928D209/Platinum%20feature%20article%20-%20Targeted%20attacks%20in%20South%20and%20Southeast%20Asia%20April%202016.pdf"}]},{"id":"S0203","name":"Hydraq","url":"https://attack.mitre.org/software/S0203","kind":"malware","description":"[Hydraq](https://attack.mitre.org/software/S0203) creates a backdoor through which remote attackers can monitor services.(Citation: Symantec Trojan.Hydraq Jan 2010)(Citation: Symantec Hydraq Jan 2010)","relationship_id":"relationship--935f8b6e-cd74-46c4-9a74-f763b4f13955","references":[{"source_name":"Symantec Trojan.Hydraq Jan 2010","description":"Symantec Security Response. (2010, January 18). The Trojan.Hydraq Incident. Retrieved February 20, 2018.","url":"https://www.symantec.com/connect/blogs/trojanhydraq-incident"},{"source_name":"Symantec Hydraq Jan 2010","description":"Lelli, A. (2010, January 11). Trojan.Hydraq. Retrieved February 20, 2018.","url":"https://www.symantec.com/security_response/writeup.jsp?docid=2010-011114-1830-99"}]},{"id":"S0219","name":"WINERACK","url":"https://attack.mitre.org/software/S0219","kind":"malware","description":"[WINERACK](https://attack.mitre.org/software/S0219) can enumerate services.(Citation: FireEye APT37 Feb 2018)","relationship_id":"relationship--cd22a7a4-6f9f-481c-9a6d-6e1c665ed6cd","references":[{"source_name":"FireEye APT37 Feb 2018","description":"FireEye. (2018, February 20). APT37 (Reaper): The Overlooked North Korean Actor. Retrieved November 17, 2024.","url":"https://services.google.com/fh/files/misc/apt37-reaper-the-overlooked-north-korean-actor.pdf"}]},{"id":"S0236","name":"Kwampirs","url":"https://attack.mitre.org/software/S0236","kind":"malware","description":"[Kwampirs](https://attack.mitre.org/software/S0236) collects a list of running services with the command <code>tasklist /svc</code>.(Citation: Symantec Orangeworm April 2018)","relationship_id":"relationship--36f0915e-66aa-4062-b909-35414c639ae1","references":[{"source_name":"Symantec Orangeworm April 2018","description":"Symantec Security Response Attack Investigation Team. (2018, April 23). New Orangeworm attack group targets the healthcare sector in the U.S., Europe, and Asia. Retrieved May 8, 2018.","url":"https://www.symantec.com/blogs/threat-intelligence/orangeworm-targets-healthcare-us-europe-asia"}]},{"id":"S0237","name":"GravityRAT","url":"https://attack.mitre.org/software/S0237","kind":"malware","description":"[GravityRAT](https://attack.mitre.org/software/S0237) has a feature to list the available services on the system.(Citation: Talos GravityRAT)","relationship_id":"relationship--948f8c8b-18e1-4652-86af-bad1dc0ec090","references":[{"source_name":"Talos GravityRAT","description":"Mercer, W., Rascagneres, P. (2018, April 26). GravityRAT - The Two-Year Evolution Of An APT Targeting India. Retrieved May 16, 2018.","url":"https://blog.talosintelligence.com/2018/04/gravityrat-two-year-evolution-of-apt.html"}]},{"id":"S0241","name":"RATANKBA","url":"https://attack.mitre.org/software/S0241","kind":"malware","description":"[RATANKBA](https://attack.mitre.org/software/S0241) uses <code>tasklist /svc</code> to display running tasks.(Citation: RATANKBA)","relationship_id":"relationship--43886571-4415-484f-931b-3b30b9aefaa7","references":[{"source_name":"RATANKBA","description":"Trend Micro. (2017, February 27). RATANKBA: Delving into Large-scale Watering Holes against Enterprises. Retrieved May 22, 2018.","url":"https://www.trendmicro.com/en_us/research/17/b/ratankba-watering-holes-against-enterprises.html"}]},{"id":"S0242","name":"SynAck","url":"https://attack.mitre.org/software/S0242","kind":"malware","description":"[SynAck](https://attack.mitre.org/software/S0242) enumerates all running services.(Citation: SecureList SynAck Doppelgänging May 2018)(Citation: Kaspersky Lab SynAck May 2018)","relationship_id":"relationship--97a083ff-40ef-4e4c-9837-4ab1537a063c","references":[{"source_name":"SecureList SynAck Doppelgänging May 2018","description":"Ivanov, A. et al. (2018, May 7). SynAck targeted ransomware uses the Doppelgänging technique. Retrieved May 22, 2018.","url":"https://securelist.com/synack-targeted-ransomware-uses-the-doppelganging-technique/85431/"},{"source_name":"Kaspersky Lab SynAck May 2018","description":"Bettencourt, J. (2018, May 7). Kaspersky Lab finds new variant of SynAck ransomware using sophisticated Doppelgänging technique. Retrieved May 24, 2018.","url":"https://usa.kaspersky.com/about/press-releases/2018_synack-doppelganging"}]},{"id":"S0244","name":"Comnie","url":"https://attack.mitre.org/software/S0244","kind":"malware","description":"[Comnie](https://attack.mitre.org/software/S0244) runs the command: <code>net start >> %TEMP%\\info.dat</code> on a victim.(Citation: Palo Alto Comnie)","relationship_id":"relationship--0c294d8b-2ee4-47ee-b9d8-8378d9d89ba1","references":[{"source_name":"Palo Alto Comnie","description":"Grunzweig, J. (2018, January 31). Comnie Continues to Target Organizations in East Asia. Retrieved June 7, 2018.","url":"https://researchcenter.paloaltonetworks.com/2018/01/unit42-comnie-continues-target-organizations-east-asia/"}]},{"id":"S0260","name":"InvisiMole","url":"https://attack.mitre.org/software/S0260","kind":"malware","description":"[InvisiMole](https://attack.mitre.org/software/S0260) can obtain running services on the victim.(Citation: ESET InvisiMole June 2018)","relationship_id":"relationship--7be0437f-1d0d-4df0-9e66-70e581cc5f1a","references":[{"source_name":"ESET InvisiMole June 2018","description":"Hromcová, Z. (2018, June 07). InvisiMole: Surprisingly equipped spyware, undercover since 2013. Retrieved July 10, 2018.","url":"https://www.welivesecurity.com/2018/06/07/invisimole-equipped-spyware-undercover/"}]},{"id":"S0266","name":"TrickBot","url":"https://attack.mitre.org/software/S0266","kind":"malware","description":"[TrickBot](https://attack.mitre.org/software/S0266) collects a list of install programs and services on the system’s machine.(Citation: S2 Grupo TrickBot June 2017)","relationship_id":"relationship--d1f44e84-61cb-4a96-add8-d37a38369e43","references":[{"source_name":"S2 Grupo TrickBot June 2017","description":"Salinas, M., Holguin, J. (2017, June). Evolution of Trickbot. Retrieved July 31, 2018.","url":"https://www.securityartwork.es/wp-content/uploads/2017/07/Trickbot-report-S2-Grupo.pdf"}]},{"id":"S0283","name":"jRAT","url":"https://attack.mitre.org/software/S0283","kind":"malware","description":"[jRAT](https://attack.mitre.org/software/S0283) can list local services.(Citation: Kaspersky Adwind Feb 2016)","relationship_id":"relationship--40da5ea7-b4d1-45a4-944e-c1c74e408086","references":[{"source_name":"Kaspersky Adwind Feb 2016","description":"Kamluk, V. & Gostev, A. (2016, February). Adwind - A Cross-Platform RAT. Retrieved April 23, 2019.","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/07195002/KL_AdwindPublicReport_2016.pdf"}]},{"id":"S0342","name":"GreyEnergy","url":"https://attack.mitre.org/software/S0342","kind":"malware","description":"[GreyEnergy](https://attack.mitre.org/software/S0342) enumerates all Windows services.(Citation: ESET GreyEnergy Oct 2018)","relationship_id":"relationship--7c58aab0-77cf-469e-836e-2b8c031afd1e","references":[{"source_name":"ESET GreyEnergy Oct 2018","description":"Cherepanov, A. (2018, October). GREYENERGY A successor to BlackEnergy. Retrieved November 15, 2018.","url":"https://www.welivesecurity.com/wp-content/uploads/2018/10/ESET_GreyEnergy.pdf"}]},{"id":"S0378","name":"PoshC2","url":"https://attack.mitre.org/software/S0378","kind":"tool","description":"[PoshC2](https://attack.mitre.org/software/S0378) can enumerate service and service permission information.(Citation: GitHub PoshC2)","relationship_id":"relationship--317b8a78-1c04-4cd7-a249-619bacfc7a44","references":[{"source_name":"GitHub PoshC2","description":"Nettitude. (2018, July 23). Python Server for PoshC2. Retrieved April 23, 2019.","url":"https://github.com/nettitude/PoshC2_Python"}]},{"id":"S0386","name":"Ursnif","url":"https://attack.mitre.org/software/S0386","kind":"malware","description":"[Ursnif](https://attack.mitre.org/software/S0386) has gathered information about running services.(Citation: TrendMicro Ursnif Mar 2015)","relationship_id":"relationship--00490a17-1032-461b-8085-500d56bb80f5","references":[{"source_name":"TrendMicro Ursnif Mar 2015","description":"Caragay, R. (2015, March 26). URSNIF: The Multifaceted Malware. Retrieved June 5, 2019.","url":"https://web.archive.org/web/20210719165945/https://www.trendmicro.com/en_us/research/15/c/ursnif-the-multifaceted-malware.html?_ga=2.165628854.808042651.1508120821-744063452.1505819992"}]},{"id":"S0398","name":"HyperBro","url":"https://attack.mitre.org/software/S0398","kind":"malware","description":"[HyperBro](https://attack.mitre.org/software/S0398) can list all services and their configurations.(Citation: Unit42 Emissary Panda May 2019)","relationship_id":"relationship--7e42e286-af96-4178-a30f-785ed3699659","references":[{"source_name":"Unit42 Emissary Panda May 2019","description":"Falcone, R. and Lancaster, T. (2019, May 28). Emissary Panda Attacks Middle East Government Sharepoint Servers. Retrieved July 9, 2019.","url":"https://unit42.paloaltonetworks.com/emissary-panda-attacks-middle-east-government-sharepoint-servers/"}]},{"id":"S0412","name":"ZxShell","url":"https://attack.mitre.org/software/S0412","kind":"malware","description":"[ZxShell](https://attack.mitre.org/software/S0412) can check the services on the system.(Citation: Talos ZxShell Oct 2014) ","relationship_id":"relationship--fd44d6f1-25c5-4365-8a68-323bfc0b3f22","references":[{"source_name":"Talos ZxShell Oct 2014","description":"Allievi, A., et al. (2014, October 28). Threat Spotlight: Group 72, Opening the ZxShell. Retrieved September 24, 2019.","url":"https://blogs.cisco.com/security/talos/opening-zxshell"}]},{"id":"S0431","name":"HotCroissant","url":"https://attack.mitre.org/software/S0431","kind":"malware","description":"[HotCroissant](https://attack.mitre.org/software/S0431) has the ability to retrieve a list of services on the infected host.(Citation: Carbon Black HotCroissant April 2020)","relationship_id":"relationship--a88e956c-6c71-47e1-b02c-d4c105542690","references":[{"source_name":"Carbon Black HotCroissant April 2020","description":"Knight, S.. (2020, April 16). VMware Carbon Black TAU Threat Analysis: The Evolution of Lazarus. Retrieved May 1, 2020.","url":"https://www.carbonblack.com/2020/04/16/vmware-carbon-black-tau-threat-analysis-the-evolution-of-lazarus/"}]},{"id":"S0496","name":"REvil","url":"https://attack.mitre.org/software/S0496","kind":"malware","description":"[REvil](https://attack.mitre.org/software/S0496) can enumerate active services.(Citation: Intel 471 REvil March 2020)","relationship_id":"relationship--965cdcbc-f139-4065-a8cd-ab09674ae20b","references":[{"source_name":"Intel 471 REvil March 2020","description":"Intel 471 Malware Intelligence team. (2020, March 31). REvil Ransomware-as-a-Service – An analysis of a ransomware affiliate operation. Retrieved August 4, 2020.","url":"https://intel471.com/blog/revil-ransomware-as-a-service-an-analysis-of-a-ransomware-affiliate-operation/"}]},{"id":"S0533","name":"SLOTHFULMEDIA","url":"https://attack.mitre.org/software/S0533","kind":"malware","description":"[SLOTHFULMEDIA](https://attack.mitre.org/software/S0533) has the capability to enumerate services.(Citation: CISA MAR SLOTHFULMEDIA October 2020)","relationship_id":"relationship--348ac89f-1a85-4ab2-887f-4e58dfc14853","references":[{"source_name":"CISA MAR SLOTHFULMEDIA October 2020","description":"DHS/CISA, Cyber National Mission Force. (2020, October 1). Malware Analysis Report (MAR) MAR-10303705-1.v1 – Remote Access Trojan: SLOTHFULMEDIA. Retrieved October 2, 2020.","url":"https://us-cert.cisa.gov/ncas/analysis-reports/ar20-275a"}]},{"id":"S0559","name":"SUNBURST","url":"https://attack.mitre.org/software/S0559","kind":"malware","description":"[SUNBURST](https://attack.mitre.org/software/S0559) collected a list of service names that were hashed using a FNV-1a + XOR algorithm to check against similarly-hashed hardcoded blocklists.(Citation: FireEye SUNBURST Backdoor December 2020)","relationship_id":"relationship--7e2ceab5-e5ae-4c79-aceb-424d42703e5f","references":[{"source_name":"FireEye SUNBURST Backdoor December 2020","description":"FireEye. (2020, December 13). Highly Evasive Attacker Leverages SolarWinds Supply Chain to Compromise Multiple Global Victims With SUNBURST Backdoor. Retrieved January 4, 2021.","url":"https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html"}]},{"id":"S0570","name":"BitPaymer","url":"https://attack.mitre.org/software/S0570","kind":"malware","description":"[BitPaymer](https://attack.mitre.org/software/S0570) can enumerate existing Windows services on the host that are configured to run as LocalSystem.(Citation: Crowdstrike Indrik November 2018)","relationship_id":"relationship--d0162247-12e2-4c0e-8efe-d5c4823e0fcd","references":[{"source_name":"Crowdstrike Indrik November 2018","description":"Frankoff, S., Hartley, B. (2018, November 14). Big Game Hunting: The Evolution of INDRIK SPIDER From Dridex Wire Fraud to BitPaymer Targeted Ransomware. Retrieved January 6, 2021.","url":"https://www.crowdstrike.com/blog/big-game-hunting-the-evolution-of-indrik-spider-from-dridex-wire-fraud-to-bitpaymer-targeted-ransomware/"}]},{"id":"S0572","name":"Caterpillar WebShell","url":"https://attack.mitre.org/software/S0572","kind":"malware","description":"[Caterpillar WebShell](https://attack.mitre.org/software/S0572) can obtain a list of the services from a system.(Citation: ClearSky Lebanese Cedar Jan 2021) ","relationship_id":"relationship--7542421c-f673-4f85-85ae-b4283173c48d","references":[{"source_name":"ClearSky Lebanese Cedar Jan 2021","description":"ClearSky Cyber Security. (2021, January). “Lebanese Cedar” APT Global Lebanese Espionage Campaign Leveraging Web Servers. Retrieved February 10, 2021.","url":"https://www.clearskysec.com/wp-content/uploads/2021/01/Lebanese-Cedar-APT.pdf"}]},{"id":"S0582","name":"LookBack","url":"https://attack.mitre.org/software/S0582","kind":"malware","description":"[LookBack](https://attack.mitre.org/software/S0582) can enumerate services on the victim machine.(Citation: Proofpoint LookBack Malware Aug 2019)","relationship_id":"relationship--651334a7-9d6c-444e-a935-1e7847abfcb1","references":[{"source_name":"Proofpoint LookBack Malware Aug 2019","description":"Raggi, M. Schwarz, D.. (2019, August 1). LookBack Malware Targets the United States Utilities Sector with Phishing Attacks Impersonating Engineering Licensing Boards. Retrieved February 25, 2021.","url":"https://www.proofpoint.com/us/threat-insight/post/lookback-malware-targets-united-states-utilities-sector-phishing-attacks"}]},{"id":"S0615","name":"SombRAT","url":"https://attack.mitre.org/software/S0615","kind":"malware","description":"[SombRAT](https://attack.mitre.org/software/S0615) can enumerate services on a victim machine.(Citation: BlackBerry CostaRicto November 2020)","relationship_id":"relationship--c8f99c96-d4f7-49dc-9ee9-0bcae28ab045","references":[{"source_name":"BlackBerry CostaRicto November 2020","description":"The BlackBerry Research and Intelligence Team. (2020, November 12). The CostaRicto Campaign: Cyber-Espionage Outsourced. Retrieved May 24, 2021.","url":"https://blogs.blackberry.com/en/2020/11/the-costaricto-campaign-cyber-espionage-outsourced"}]},{"id":"S0625","name":"Cuba","url":"https://attack.mitre.org/software/S0625","kind":"malware","description":"[Cuba](https://attack.mitre.org/software/S0625) can query service status using <code>QueryServiceStatusEx</code> function.(Citation: McAfee Cuba April 2021)","relationship_id":"relationship--974cd5a0-3519-4488-a935-06a0ef498f46","references":[{"source_name":"McAfee Cuba April 2021","description":"Roccio, T., et al. (2021, April). Technical Analysis of Cuba Ransomware. Retrieved June 18, 2021.","url":"https://www.mcafee.com/enterprise/en-us/assets/reports/rp-cuba-ransomware.pdf"}]},{"id":"S0629","name":"RainyDay","url":"https://attack.mitre.org/software/S0629","kind":"malware","description":"[RainyDay](https://attack.mitre.org/software/S0629) can create and register a service for execution.(Citation: Bitdefender Naikon April 2021)","relationship_id":"relationship--56b8f3d1-c08e-42a1-8d14-b961391eaaa7","references":[{"source_name":"Bitdefender Naikon April 2021","description":"Vrabie, V. (2021, April 23). NAIKON – Traces from a Military Cyber-Espionage Operation. Retrieved June 29, 2021.","url":"https://www.bitdefender.com/files/News/CaseStudies/study/396/Bitdefender-PR-Whitepaper-NAIKON-creat5397-en-EN.pdf"}]},{"id":"S0638","name":"Babuk","url":"https://attack.mitre.org/software/S0638","kind":"malware","description":"[Babuk](https://attack.mitre.org/software/S0638) can enumerate all services running on a compromised host.(Citation: McAfee Babuk February 2021)","relationship_id":"relationship--bebaff50-23e0-43d6-ad31-4d84a3b2af73","references":[{"source_name":"McAfee Babuk February 2021","description":"Mundo, A. et al. (2021, February). Technical Analysis of Babuk Ransomware. Retrieved August 11, 2021.","url":"https://www.mcafee.com/enterprise/en-us/assets/reports/rp-babuk-ransomware.pdf"}]},{"id":"S0663","name":"SysUpdate","url":"https://attack.mitre.org/software/S0663","kind":"malware","description":"[SysUpdate](https://attack.mitre.org/software/S0663) can collect a list of services on a victim machine.(Citation: Lunghi Iron Tiger Linux)","relationship_id":"relationship--10bb2d06-6158-4cf2-bd35-0840a8e0a129","references":[{"source_name":"Lunghi Iron Tiger Linux","description":"Daniel Lunghi. (2023, March 1). Iron Tiger’s SysUpdate Reappears, Adds Linux Targeting. Retrieved March 20, 2023.","url":"https://www.trendmicro.com/en_us/research/23/c/iron-tiger-sysupdate-adds-linux-targeting.html"}]},{"id":"S0692","name":"SILENTTRINITY","url":"https://attack.mitre.org/software/S0692","kind":"tool","description":"[SILENTTRINITY](https://attack.mitre.org/software/S0692) can search for modifiable services that could be used for privilege escalation.(Citation: GitHub SILENTTRINITY Modules July 2019)","relationship_id":"relationship--fd68dcb1-686c-4e48-9b6c-26c98a4f43e5","references":[{"source_name":"GitHub SILENTTRINITY Modules July 2019","description":"Salvati, M. (2019, August 6). SILENTTRINITY Modules. Retrieved March 24, 2022.","url":"https://github.com/byt3bl33d3r/SILENTTRINITY/tree/master/silenttrinity/core/teamserver/modules/boo"}]},{"id":"S1027","name":"Heyoka Backdoor","url":"https://attack.mitre.org/software/S1027","kind":"malware","description":"[Heyoka Backdoor](https://attack.mitre.org/software/S1027) can check if it is running as a service on a compromised host.(Citation: SentinelOne Aoqin Dragon June 2022)","relationship_id":"relationship--6b68eccb-bb48-40fd-bf3e-4bc60a51a8e1","references":[{"source_name":"SentinelOne Aoqin Dragon June 2022","description":"Chen, Joey. (2022, June 9). Aoqin Dragon | Newly-Discovered Chinese-linked APT Has Been Quietly Spying On Organizations For 10 Years. Retrieved July 14, 2022.","url":"https://www.sentinelone.com/labs/aoqin-dragon-newly-discovered-chinese-linked-apt-has-been-quietly-spying-on-organizations-for-10-years/"}]},{"id":"S1066","name":"DarkTortilla","url":"https://attack.mitre.org/software/S1066","kind":"malware","description":"[DarkTortilla](https://attack.mitre.org/software/S1066) can retrieve information about a compromised system's running services.(Citation: Secureworks DarkTortilla Aug 2022)","relationship_id":"relationship--ba27eb37-39dc-47ee-b87f-95525878582e","references":[{"source_name":"Secureworks DarkTortilla Aug 2022","description":"Secureworks Counter Threat Unit Research Team. (2022, August 17). DarkTortilla Malware Analysis. Retrieved November 3, 2022.","url":"https://www.secureworks.com/research/darktortilla-malware-analysis"}]},{"id":"S1070","name":"Black Basta","url":"https://attack.mitre.org/software/S1070","kind":"malware","description":"[Black Basta](https://attack.mitre.org/software/S1070) can check whether the service name `FAX` is present.(Citation: Cyble Black Basta May 2022)","relationship_id":"relationship--8b02a707-94ba-4c61-8292-d9dce02606b3","references":[{"source_name":"Cyble Black Basta May 2022","description":"Cyble. (2022, May 6). New ransomware variant targeting high-value organizations. Retrieved November 17, 2024.","url":"https://web.archive.org/web/20220506143054/https://blog.cyble.com/2022/05/06/black-basta-ransomware/"}]},{"id":"S1085","name":"Sardonic","url":"https://attack.mitre.org/software/S1085","kind":"malware","description":"[Sardonic](https://attack.mitre.org/software/S1085) has the ability to execute the `net start` command.(Citation: Bitdefender Sardonic Aug 2021)","relationship_id":"relationship--a86529ff-e584-4566-afb9-6ffc366fd154","references":[{"source_name":"Bitdefender Sardonic Aug 2021","description":"Budaca, E., et al. (2021, August 25). FIN8 Threat Actor Goes Agile with New Sardonic Backdoor. Retrieved August 9, 2023.","url":"https://www.bitdefender.com/files/News/CaseStudies/study/401/Bitdefender-PR-Whitepaper-FIN8-creat5619-en-EN.pdf"}]},{"id":"S1228","name":"PUBLOAD","url":"https://attack.mitre.org/software/S1228","kind":"malware","description":"[PUBLOAD](https://attack.mitre.org/software/S1228) has leveraged `tasklist` to gather running services on victim host.(Citation: Trend Micro MUSTANG PANDA PUBLOAD HIUPAN SEPTEMBER 2024)","relationship_id":"relationship--d2543f5c-6079-4540-8250-d4b900b64f42","references":[{"source_name":"Trend Micro MUSTANG PANDA PUBLOAD HIUPAN SEPTEMBER 2024","description":"Lenart Bermejo, Sunny Lu, Ted Lee. (2024, September 9). Earth Preta Evolves its Attacks with New Malware and Strategies. Retrieved August 4, 2025.","url":"https://www.trendmicro.com/en_us/research/24/i/earth-preta-new-malware-and-strategies.html"}]},{"id":"S1242","name":"Qilin","url":"https://attack.mitre.org/software/S1242","kind":"malware","description":"[Qilin](https://attack.mitre.org/software/S1242) can identify specific services for termination or to be left running at execution.(Citation: Trend Micro Agenda Ransomware AUG 2022)(Citation: SentinelOne Qilin NOV 2022)(Citation: HC3 Qilin Threat Profile JUN 2024)(Citation: Cisco Talos Qilin Ransomware OCT 2025)","relationship_id":"relationship--7120230b-c8b3-4e70-a9a9-9edd2214ef09","references":[{"source_name":"HC3 Qilin Threat Profile JUN 2024","description":"Health Sector Cybersecurity Coordination Center. (2024, June 18). Qilin, aka Agenda Ransomware. Retrieved September 26, 2025.","url":"https://www.aha.org/system/files/media/file/2024/06/tlp-clear-hc3-threat-profile-qilin-aka-agenda-ransomware-6-18-2024.pdf"},{"source_name":"Trend Micro Agenda Ransomware AUG 2022","description":"Magdy, S. et al. (2022, August 25). New Golang Ransomware Agenda Customizes Attacks. Retrieved September 26, 2025.","url":"https://www.trendmicro.com/en_us/research/22/h/new-golang-ransomware-agenda-customizes-attacks.html"},{"source_name":"SentinelOne Qilin NOV 2022","description":"SentinelOne. (2022, November 30). Agenda (Qilin). Retrieved September 26, 2025.","url":"https://www.sentinelone.com/anthology/agenda-qilin/"},{"source_name":"Cisco Talos Qilin Ransomware OCT 2025","description":"Takeda, T. et al. (2025, October 26). Uncovering Qilin attack methods exposed through multiple cases. Retrieved March 26, 2026.","url":"https://blog.talosintelligence.com/uncovering-qilin-attack-methods-exposed-through-multiple-cases/"}]},{"id":"S1244","name":"Medusa Ransomware","url":"https://attack.mitre.org/software/S1244","kind":"malware","description":"[Medusa Ransomware](https://attack.mitre.org/software/S1244) has leveraged an encoded list of services that it designates for termination.(Citation: Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024)(Citation: Broadcom Medusa Ransomware Medusa Group March 2025)(Citation: Security Scorecard Medusa Ransomware January 2024)","relationship_id":"relationship--34939c90-9f24-4141-9fe2-f9b150f813d8","references":[{"source_name":"Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024","description":"Anthony Galiette, Doel Santos. (2024, January 11). Medusa Ransomware Turning Your Files into Stone. Retrieved October 15, 2025.","url":"https://unit42.paloaltonetworks.com/medusa-ransomware-escalation-new-leak-site/"},{"source_name":"Broadcom Medusa Ransomware Medusa Group March 2025","description":"Threat Hunter Team Symantec and Carbon Black. (2025, March 6). Medusa Ransomware Activity Continues to Increase. Retrieved October 15, 2025.","url":"https://www.security.com/threat-intelligence/medusa-ransomware-attacks"},{"source_name":"Security Scorecard Medusa Ransomware January 2024","description":"Vlad Pasca. (2024, January 1). A Deep Dive into Medusa Ransomware. Retrieved October 15, 2025.","url":"https://securityscorecard.com/wp-content/uploads/2024/01/deep-dive-into-medusa-ransomware.pdf"}]},{"id":"S1247","name":"Embargo","url":"https://attack.mitre.org/software/S1247","kind":"malware","description":"[Embargo](https://attack.mitre.org/software/S1247) has obtained active services running on the victim’s system through the functions `OpenSCManagerW()` and `EnumServicesStatusExW()`.(Citation: Cyble Embargo Ransomware May 2024)","relationship_id":"relationship--930be2c9-08a1-453f-8149-4677cdcb6c3b","references":[{"source_name":"Cyble Embargo Ransomware May 2024","description":"Cyble. (2024, May 24). The Rust Revolution: New Embargo Ransomware Steps In. Retrieved October 19, 2025.","url":"https://cyble.com/blog/the-rust-revolution-new-embargo-ransomware-steps-in/"}]},{"id":"S9035","name":"LAMEHUG","url":"https://attack.mitre.org/software/S9035","kind":"malware","description":"[LAMEHUG](https://attack.mitre.org/software/S9035) can gather service information on targeted systems.(Citation: Nov AI Threat Tracker)(Citation: Cato LAMEHUG JUL 2025)","relationship_id":"relationship--d3d8bcd3-9ea1-4bea-bcce-d8c302680c7a","references":[{"source_name":"Nov AI Threat Tracker","description":"Google Threat Intelligence Group. (2025, November 5). GTIG AI Threat Tracker: Advances in Threat Actor Usage of AI Tools. Retrieved March 31, 2026.","url":"https://cloud.google.com/blog/topics/threat-intelligence/threat-actor-usage-of-ai-tools"},{"source_name":"Cato LAMEHUG JUL 2025","description":"Simonovich, V. (2025, July 23). Cato CTRL™ Threat Research: Analyzing LAMEHUG – First Known LLM-Powered Malware with Links to APT28 (Fancy Bear) . Retrieved April 21, 2026.","url":"https://www.catonetworks.com/blog/cato-ctrl-threat-research-analyzing-lamehug/"}]}],"actors":[{"id":"G0004","name":"Ke3chang","url":"https://attack.mitre.org/groups/G0004","kind":"intrusion-set","description":"[Ke3chang](https://attack.mitre.org/groups/G0004) performs service discovery using <code>net start</code> commands.(Citation: Mandiant Operation Ke3chang November 2014)","relationship_id":"relationship--7b529102-f95c-4ca1-a5c4-5a3497ab3674","references":[{"source_name":"Mandiant Operation Ke3chang November 2014","description":"Villeneuve, N., Bennett, J. T., Moran, N., Haq, T., Scott, M., & Geers, K. (2014). OPERATION “KE3CHANG”: Targeted Attacks Against Ministries of Foreign Affairs. Retrieved November 12, 2014.","url":"https://www.mandiant.com/resources/operation-ke3chang-targeted-attacks-against-ministries-of-foreign-affairs"}]},{"id":"G0006","name":"APT1","url":"https://attack.mitre.org/groups/G0006","kind":"intrusion-set","description":"[APT1](https://attack.mitre.org/groups/G0006) used the commands <code>net start</code> and <code>tasklist</code> to get a listing of the services on the system.(Citation: Mandiant APT1)","relationship_id":"relationship--f9c7127d-2a27-4dcf-bef5-9150a6c4334d","references":[{"source_name":"Mandiant APT1","description":"Mandiant. (n.d.). APT1 Exposing One of China’s Cyber Espionage Units. Retrieved July 18, 2016.","url":"https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf"}]},{"id":"G0010","name":"Turla","url":"https://attack.mitre.org/groups/G0010","kind":"intrusion-set","description":"[Turla](https://attack.mitre.org/groups/G0010) surveys a system upon check-in to discover running services and associated processes using the <code>tasklist /svc</code> command.(Citation: Kaspersky Turla)","relationship_id":"relationship--52c18ed1-91a5-4394-a4d0-f700c75bf3d9","references":[{"source_name":"Kaspersky Turla","description":"Kaspersky Lab's Global Research and Analysis Team. (2014, August 7). The Epic Turla Operation: Solving some of the mysteries of Snake/Uroburos. Retrieved December 11, 2014.","url":"https://securelist.com/the-epic-turla-operation/65545/"}]},{"id":"G0018","name":"admin@338","url":"https://attack.mitre.org/groups/G0018","kind":"intrusion-set","description":"[admin@338](https://attack.mitre.org/groups/G0018) actors used the following command following exploitation of a machine with [LOWBALL](https://attack.mitre.org/software/S0042) malware to obtain information about services: <code>net start >> %temp%\\download</code>(Citation: FireEye admin@338)","relationship_id":"relationship--e6e324d1-b775-48bb-ac9f-02fcc2428752","references":[{"source_name":"FireEye admin@338","description":"FireEye Threat Intelligence. (2015, December 1). China-based Cyber Threat Group Uses Dropbox for Malware Communications and Targets Hong Kong Media Outlets. Retrieved December 4, 2015.","url":"https://www.fireeye.com/blog/threat-research/2015/11/china-based-threat.html"}]},{"id":"G0033","name":"Poseidon Group","url":"https://attack.mitre.org/groups/G0033","kind":"intrusion-set","description":"After compromising a victim, [Poseidon Group](https://attack.mitre.org/groups/G0033) discovers all running services.(Citation: Kaspersky Poseidon Group)","relationship_id":"relationship--720be590-5ea0-43b6-8360-fa75dd4d1a67","references":[{"source_name":"Kaspersky Poseidon Group","description":"Kaspersky Lab's Global Research and Analysis Team. (2016, February 9). Poseidon Group: a Targeted Attack Boutique specializing in global cyber-espionage. Retrieved March 16, 2016.","url":"https://securelist.com/poseidon-group-a-targeted-attack-boutique-specializing-in-global-cyber-espionage/73673/"}]},{"id":"G0049","name":"OilRig","url":"https://attack.mitre.org/groups/G0049","kind":"intrusion-set","description":"[OilRig](https://attack.mitre.org/groups/G0049) has used <code>sc query</code> on a victim to gather information about services.(Citation: Palo Alto OilRig May 2016)","relationship_id":"relationship--4923be5e-dd24-4289-adca-e9dbf545b9c2","references":[{"source_name":"Palo Alto OilRig May 2016","description":"Falcone, R. and Lee, B.. (2016, May 26). The OilRig Campaign: Attacks on Saudi Arabian Organizations Deliver Helminth Backdoor. Retrieved May 3, 2017.","url":"http://researchcenter.paloaltonetworks.com/2016/05/the-oilrig-campaign-attacks-on-saudi-arabian-organizations-deliver-helminth-backdoor/"}]},{"id":"G0060","name":"BRONZE BUTLER","url":"https://attack.mitre.org/groups/G0060","kind":"intrusion-set","description":"[BRONZE BUTLER](https://attack.mitre.org/groups/G0060) has used TROJ_GETVERSION to discover system services.(Citation: Trend Micro Tick November 2019)","relationship_id":"relationship--069d3677-2694-4385-b5c3-ea6e231d26d9","references":[{"source_name":"Trend Micro Tick November 2019","description":"Chen, J. et al. (2019, November). Operation ENDTRADE: TICK’s Multi-Stage Backdoors for Attacking Industries and Stealing Classified Data. Retrieved June 9, 2020.","url":"https://documents.trendmicro.com/assets/pdf/Operation-ENDTRADE-TICK-s-Multi-Stage-Backdoors-for-Attacking-Industries-and-Stealing-Classified-Data.pdf"}]},{"id":"G0094","name":"Kimsuky","url":"https://attack.mitre.org/groups/G0094","kind":"intrusion-set","description":"[Kimsuky](https://attack.mitre.org/groups/G0094) has used an instrumentor script to gather the names of all services running on a victim's system.(Citation: Talos Kimsuky Nov 2021)","relationship_id":"relationship--73d7126b-3e7a-441c-93e0-9803aec12ca5","references":[{"source_name":"Talos Kimsuky Nov 2021","description":"An, J and Malhotra, A. (2021, November 10). North Korean attackers use malicious blogs to deliver malware to high-profile South Korean targets. Retrieved December 29, 2021.","url":"https://blog.talosintelligence.com/2021/11/kimsuky-abuses-blogs-delivers-malware.html"}]},{"id":"G0114","name":"Chimera","url":"https://attack.mitre.org/groups/G0114","kind":"intrusion-set","description":"[Chimera](https://attack.mitre.org/groups/G0114) has used <code>net start</code> and <code>net use</code> for system service discovery.(Citation: NCC Group Chimera January 2021)","relationship_id":"relationship--7944bf15-8e56-4624-8776-bc9fc5aee249","references":[{"source_name":"NCC Group Chimera January 2021","description":"Jansen, W . (2021, January 12). Abusing cloud services to fly under the radar. Retrieved September 12, 2024.","url":"https://web.archive.org/web/20230218064220/https://research.nccgroup.com/2021/01/12/abusing-cloud-services-to-fly-under-the-radar/"}]},{"id":"G0119","name":"Indrik Spider","url":"https://attack.mitre.org/groups/G0119","kind":"intrusion-set","description":"[Indrik Spider](https://attack.mitre.org/groups/G0119) has used the win32_service WMI class to retrieve a list of services from the system.(Citation: Symantec WastedLocker June 2020) ","relationship_id":"relationship--342a3da9-79e7-4fdc-8a08-bd7f54caa2ac","references":[{"source_name":"Symantec WastedLocker June 2020","description":"Symantec Threat Intelligence. (2020, June 25). WastedLocker: Symantec Identifies Wave of Attacks Against U.S. Organizations. Retrieved May 20, 2021.","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/wastedlocker-ransomware-us"}]},{"id":"G0139","name":"TeamTNT","url":"https://attack.mitre.org/groups/G0139","kind":"intrusion-set","description":"[TeamTNT](https://attack.mitre.org/groups/G0139) has searched for services such as Alibaba Cloud Security's aliyun service and BMC Helix Cloud Security's bmc-agent service in order to disable them.(Citation: Cisco Talos Intelligence Group)","relationship_id":"relationship--26d1ecff-471e-420d-a1f0-d7b6cf9a07e6","references":[{"source_name":"Cisco Talos Intelligence Group","description":"Darin Smith. (2022, April 21). TeamTNT targeting AWS, Alibaba. Retrieved August 4, 2022.","url":"https://blog.talosintelligence.com/teamtnt-targeting-aws-alibaba-2/"}]},{"id":"G0143","name":"Aquatic Panda","url":"https://attack.mitre.org/groups/G0143","kind":"intrusion-set","description":"[Aquatic Panda](https://attack.mitre.org/groups/G0143) has attempted to discover services for third party EDR products.(Citation: CrowdStrike AQUATIC PANDA December 2021)","relationship_id":"relationship--6ba11730-a404-4252-aefe-acbf71877b0c","references":[{"source_name":"CrowdStrike AQUATIC PANDA December 2021","description":"Wiley, B. et al. (2021, December 29). OverWatch Exposes AQUATIC PANDA in Possession of Log4Shell Exploit Tools During Hands-on Intrusion Attempt. Retrieved January 18, 2022.","url":"https://www.crowdstrike.com/blog/overwatch-exposes-aquatic-panda-in-possession-of-log-4-shell-exploit-tools/"}]},{"id":"G1006","name":"Earth Lusca","url":"https://attack.mitre.org/groups/G1006","kind":"intrusion-set","description":"[Earth Lusca](https://attack.mitre.org/groups/G1006) has used [Tasklist](https://attack.mitre.org/software/S0057) to obtain information from a compromised host.(Citation: TrendMicro EarthLusca 2022)","relationship_id":"relationship--aae6444e-c9e5-4965-9499-8aa6d546b58e","references":[{"source_name":"TrendMicro EarthLusca 2022","description":"Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022.","url":"https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/a/earth-lusca-employs-sophisticated-infrastructure-varied-tools-and-techniques/technical-brief-delving-deep-an-analysis-of-earth-lusca-operations.pdf"}]},{"id":"G1017","name":"Volt Typhoon","url":"https://attack.mitre.org/groups/G1017","kind":"intrusion-set","description":"[Volt Typhoon](https://attack.mitre.org/groups/G1017) has used `net start` to list running services.(Citation: CISA AA24-038A PRC Critical Infrastructure February 2024)","relationship_id":"relationship--ad6fdc42-3f34-4412-b1a8-3af6728917f7","references":[{"source_name":"CISA AA24-038A PRC Critical Infrastructure February 2024","description":"CISA et al.. (2024, February 7). PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure. Retrieved May 15, 2024.","url":"https://www.cisa.gov/sites/default/files/2024-03/aa24-038a_csa_prc_state_sponsored_actors_compromise_us_critical_infrastructure_3.pdf"}]},{"id":"G1054","name":"MirrorFace","url":"https://attack.mitre.org/groups/G1054","kind":"intrusion-set","description":"[MirrorFace](https://attack.mitre.org/groups/G1054) has used [Tasklist](https://attack.mitre.org/software/S0057) for discovery post compromise.(Citation: JPCERT MirrorFace JUL 2024)","relationship_id":"relationship--a79d18de-bfcc-4b15-b50e-2dc9d707ec58","references":[{"source_name":"JPCERT MirrorFace JUL 2024","description":"Tomonaga, S. (2024, July 16). MirrorFace Attack against Japanese Organisations. Retrieved April 17, 2026.","url":"https://blogs.jpcert.or.jp/en/2024/07/mirrorface-attack-against-japanese-organisations.html"}]},{"id":"G1059","name":"NIMBUS MANTICORE","url":"https://attack.mitre.org/groups/G1059","kind":"intrusion-set","description":"[NIMBUS MANTICORE](https://attack.mitre.org/groups/G1059) has identified running services using remote management services to include Atelier Web Remote Commander (AWRC).(Citation: Mandiant_UNC1549TTPsTools_Nov2025)    ","relationship_id":"relationship--e92fe381-6537-4cd1-9e30-bb8f0724498d","references":[{"source_name":"Mandiant_UNC1549TTPsTools_Nov2025","description":"El-Banna, M., et al. (2025, November 17). Frontline Intelligence: Analysis of UNC1549 TTPs, Custom Tools, and Malware Targeting the Aerospace and Defense Ecosystem. Retrieved September 28, 2026.","url":"https://cloud.google.com/blog/topics/threat-intelligence/analysis-of-unc1549-ttps-targeting-aerospace-defense"}]}],"mitigations":[],"candidates":[{"id":"51f17016-d8fa-4360-888a-df4bf92c4a04","name":"Get-Service Execution","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1007/T1007.yaml","description":"Executes the Get-Service cmdlet to gather objects representing all services on the local system.","inputs":{},"dependencies":[],"source_definition_sha256":"05c3c0c9c26821366a0e3d4248637a1b8d4850bf6a5270419f166528e0745338"},{"id":"5f864a3f-8ce9-45c0-812c-bdf7d8aeacc3","name":"System Service Discovery - net.exe","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":false,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1007/T1007.yaml","description":"Enumerates started system services using net.exe and writes them to a file. This technique has been used by multiple threat actors.\n\nUpon successful execution, net.exe will run from cmd.exe that queries services. Expected output is to a txt file in in the temp directory called service-list.txt.\n","inputs":{"output_file":{"description":"Path of file to hold net.exe output","type":"path","default":"%temp%\\service-list.txt"}},"dependencies":[],"source_definition_sha256":"b59c2d23bda292c3e509bf31538754329d331695eca8d5b72891baab801ac74d"},{"id":"7cd7eaa3-9ccc-460d-96d2-c6fb13e6d58a","name":"System Service Discovery - Windows Scheduled Tasks (schtasks)","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1007/T1007.yaml","description":"Enumerates scheduled tasks on Windows using schtasks.exe.\n","inputs":{},"dependencies":[],"source_definition_sha256":"abb142aa221a11f638a74dcbcc9e28b9ddb6246d3ee8e74c8173944917875ff0"},{"id":"89676ba1-b1f8-47ee-b940-2e1a113ebc71","name":"System Service Discovery","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":true,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1007/T1007.yaml","description":"Identify system services.\n\nUpon successful execution, cmd.exe will execute service commands with expected result to stdout.\n","inputs":{},"dependencies":[],"source_definition_sha256":"7acb91791622e40f0d719bcaf6e924eb1815bce42854a35fed5519be222c2b92"},{"id":"8f2a5d2b-4018-46d4-8f3f-0fea53754690","name":"System Service Discovery - Linux init scripts","platforms":["linux"],"method":"automated","executor":"sh","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1007/T1007.yaml","description":"Enumerates system services by listing SysV init scripts and runlevel\nsymlinks under /etc/init.d and /etc/rc*.d.\n","inputs":{},"dependencies":[],"source_definition_sha256":"70b9cb5225f25998e097097ac1637ccab47541369a190b4bbbaa27b2540d0419"},{"id":"9b378962-a75e-4856-b117-2503d6dcebba","name":"System Service Discovery - macOS launchctl","platforms":["macos"],"method":"automated","executor":"sh","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1007/T1007.yaml","description":"Enumerates services on macOS using launchctl. Used by adversaries for\nidentifying daemons, background services, and persistence mechanisms.\n","inputs":{},"dependencies":[],"source_definition_sha256":"19c8f15843077ab25469b014fe23e6d204e4be96a083b6437c63a5f4afd2158f"},{"id":"d70d82bd-bb00-4837-b146-b40d025551b2","name":"System Service Discovery - Services Registry Enumeration","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1007/T1007.yaml","description":"Enumerates Windows services by reading the Services registry key\n(HKLM\\SYSTEM\\CurrentControlSet\\Services) instead of using Service Control\nManager APIs or CLI tools such as sc.exe or Get-Service.\n","inputs":{},"dependencies":[],"source_definition_sha256":"97dbec1ececfa6ddba213726bf82eb248a1c5e78cdc290c3852f9c250740cfc8"},{"id":"f4b26bce-4c2c-46c0-bcc5-fce062d38bef","name":"System Service Discovery - systemctl/service","platforms":["linux"],"method":"automated","executor":"bash","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1007/T1007.yaml","description":"Enumerates system service using systemctl/service\n","inputs":{},"dependencies":[],"source_definition_sha256":"7f39447bd6b3d1212ed848b6838fddf70781b81614f33dca07d4c803bfd76bc8"}],"simulation":{"atomic_status":"documented_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1007":"/ttp-simulation/techniques/enterprise/T1007/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"enterprise/T1007","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0064","collector":"illustrative-lab-collector","observation":{"interpreter":"/bin/sh","command_line":"printf LAB_TELEMETRY_CHECK","actor_uid":1000,"session_id":"lab-session-1"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}}]}}