1200KM / detection
T1007 System Service Discovery — Detection Rules
Detection workspace for T1007 System Service Discovery: 8 Sigma sources, 0 Atlas concepts and 0 anomaly models. No live detection validation.
Source-backed rule directory
- Crontab Enumeration · test · low · {"product":"linux","category":"process_creation"}
- ESXi Network Configuration Discovery Via ESXCLI · test · medium · {"category":"process_creation","product":"linux"}
- ESXi Storage Information Discovery Via ESXCLI · test · medium · {"category":"process_creation","product":"linux"}
- ESXi System Information Discovery Via ESXCLI · test · medium · {"category":"process_creation","product":"linux"}
- ESXi VM List Discovery Via ESXCLI · test · medium · {"category":"process_creation","product":"linux"}
- ESXi VSAN Information Discovery Via ESXCLI · test · medium · {"category":"process_creation","product":"linux"}
- HackTool - PCHunter Execution · test · high · {"category":"process_creation","product":"windows"}
- Potential Configuration And Service Reconnaissance Via Reg.EXE · test · medium · {"category":"process_creation","product":"windows"}
Atlas deterministic concepts
No exact concept selected.
Anomaly models
No exact Atlas model in this snapshot.
ATT&CK analytic guidance
DET0483 Detection of System Service Discovery Commands Across OS Platforms
AN1325 Analytic 1325
Enumeration of services via native CLI tools (e.g., `sc query`, `tasklist /svc`, `net start`) or API calls via PowerShell and WMI.
AN1326 Analytic 1326
Execution of service management commands like `systemctl list-units`, `service --status-all`, or direct reading of `/etc/init.d`.
AN1327 Analytic 1327
Discovery via launchctl commands, or process enumeration using `ps aux | grep com.apple.` to identify daemons and services.
Connected ecosystem references
Linked tags
Simulation, tools and telemetry
Threat actor context
These are explicit actor-to-technique associations in the existing Threat Matrix snapshot, not attribution of an event or proof that a detector identifies the actor. No tool-to-actor relationship is inferred.
Existing anomaly research
Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.