Cross-source coverage

T1007 / ATT&CK

System Service Discovery

22 rules · 21 families across 4 sources.

1 deprecated hidden · include

From MITRE ATT&CK 19.2

Adversaries may try to gather information about registered local system services. Adversaries may obtain information about services using tools as well as OS utility commands such as sc query, tasklist /svc, systemctl --type=service, and net start. Adversaries may also gather information about schedule tasks via commands such as schtasks on Windows or crontab -l on Linux and macOS.

Adversaries may use the information from System Service Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.

Tactics
Discovery
Platforms
Linux · macOS · Windows
Telemetry
WinEventLog:SecurityWinEventLog:PowerShellauditd:EXECVEmacos:unifiedlogmacos:osquery

How MITRE says to detect it DET0483

Detection of System Service Discovery Commands Across OS Platforms

Windows Analytic 1325

Enumeration of services via native CLI tools (e.g., `sc query`, `tasklist /svc`, `net start`) or API calls via PowerShell and WMI.

  • WinEventLog:Security EventCode=4688
  • WinEventLog:PowerShell EventCode=4103, 4104, 4105, 4106

Linux Analytic 1326

Execution of service management commands like `systemctl list-units`, `service --status-all`, or direct reading of `/etc/init.d`.

  • auditd:EXECVE execve

macOS Analytic 1327

Discovery via launchctl commands, or process enumeration using `ps aux | grep com.apple.` to identify daemons and services.

  • macos:unifiedlog None
  • macos:osquery process_events

View on attack.mitre.org ↗

SigmaHQ/sigma

11 rules
Detection Severity Format
HackTool - PCHunter Execution High Sigma
ESXi Network Configuration Discovery Via ESXCLI Medium Sigma
ESXi Storage Information Discovery Via ESXCLI Medium Sigma
ESXi System Information Discovery Via ESXCLI Medium Sigma
ESXi VM List Discovery Via ESXCLI Medium Sigma
ESXi VSAN Information Discovery Via ESXCLI Medium Sigma
Potential Configuration And Service Reconnaissance Via Reg.EXE Medium Sigma
Potential Registry Reconnaissance Via PowerShell Script Medium Sigma
Crontab Enumeration Low Sigma
Net.EXE Execution Low Sigma

+ 1 more from SigmaHQ/sigma → showing the 10 highest-severity

socfortress/Wazuh-Rules

7 rules · 6 families
Detection Severity Format
Sysmon - Event 1: Process creation · net.exe start Service List (T1007) High Wazuh XML
Sysmon - Event 1: Process creation · PowerShell Get-Service Enumeration (T1007) High Wazuh XML
Sysmon - Event 1: Process creation · SC Query Services (T1007) High Wazuh XML
Sysmon - Event 1: Process creation · System Service Discovery (T1007) 2 variants High Wazuh XML
Sysmon - Event 1: Process creation · Tasklist Service View (T1007) High Wazuh XML
System service enumeration using systemctl detected Medium Wazuh XML
Sysmon - Event 1: Process creation · System Service Discovery (T1007) 2 variants Low Wazuh XML

elastic/detection-rules

2 rules
Detection Severity Format
Enumeration Command Spawned via WMIPrvSE Low Elastic TOML
PowerShell Suspicious Discovery Related Windows API Functions Low Elastic TOML

splunk/security_content

2 rules
Detection Severity Format
Windows Net System Service Discovery Undefined SPL
Windows WinPEAS PowerShell Script Execution Undefined SPL

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.