Cross-source coverage
T1007 / ATT&CK
System Service Discovery
23 rules · 22 families across 5 sources.
Showing deprecated rules · back to the default
From MITRE ATT&CK 19.2
Adversaries may try to gather information about registered local system services. Adversaries may obtain information about services using tools as well as OS utility commands such as sc query, tasklist /svc, systemctl --type=service, and net start. Adversaries may also gather information about schedule tasks via commands such as schtasks on Windows or crontab -l on Linux and macOS.
Adversaries may use the information from System Service Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
- Tactics
- Discovery
- Platforms
- Linux · macOS · Windows
- Telemetry
-
WinEventLog:SecurityWinEventLog:PowerShellauditd:EXECVEmacos:unifiedlogmacos:osquery
How MITRE says to detect it DET0483
Detection of System Service Discovery Commands Across OS Platforms
Windows Analytic 1325
Enumeration of services via native CLI tools (e.g., `sc query`, `tasklist /svc`, `net start`) or API calls via PowerShell and WMI.
WinEventLog:SecurityEventCode=4688WinEventLog:PowerShellEventCode=4103, 4104, 4105, 4106
Linux Analytic 1326
Execution of service management commands like `systemctl list-units`, `service --status-all`, or direct reading of `/etc/init.d`.
auditd:EXECVEexecve
macOS Analytic 1327
Discovery via launchctl commands, or process enumeration using `ps aux | grep com.apple.` to identify daemons and services.
macos:unifiedlogNonemacos:osqueryprocess_events
SigmaHQ/sigma
11 rules| Detection | Severity | Format |
|---|---|---|
| HackTool - PCHunter Execution | High | Sigma |
| ESXi Network Configuration Discovery Via ESXCLI | Medium | Sigma |
| ESXi Storage Information Discovery Via ESXCLI | Medium | Sigma |
| ESXi System Information Discovery Via ESXCLI | Medium | Sigma |
| ESXi VM List Discovery Via ESXCLI | Medium | Sigma |
| ESXi VSAN Information Discovery Via ESXCLI | Medium | Sigma |
| Potential Configuration And Service Reconnaissance Via Reg.EXE | Medium | Sigma |
| Potential Registry Reconnaissance Via PowerShell Script | Medium | Sigma |
| Crontab Enumeration | Low | Sigma |
| Net.EXE Execution | Low | Sigma |
+ 1 more from SigmaHQ/sigma → showing the 10 highest-severity
socfortress/Wazuh-Rules
7 rules · 6 families| Detection | Severity | Format |
|---|---|---|
| Sysmon - Event 1: Process creation · net.exe start Service List (T1007) | High | Wazuh XML |
| Sysmon - Event 1: Process creation · PowerShell Get-Service Enumeration (T1007) | High | Wazuh XML |
| Sysmon - Event 1: Process creation · SC Query Services (T1007) | High | Wazuh XML |
| Sysmon - Event 1: Process creation · System Service Discovery (T1007) 2 variants | High | Wazuh XML |
| Sysmon - Event 1: Process creation · Tasklist Service View (T1007) | High | Wazuh XML |
| System service enumeration using systemctl detected | Medium | Wazuh XML |
| Sysmon - Event 1: Process creation · System Service Discovery (T1007) 2 variants | Low | Wazuh XML |
elastic/detection-rules
2 rules| Detection | Severity | Format |
|---|---|---|
| Enumeration Command Spawned via WMIPrvSE | Low | Elastic TOML |
| PowerShell Suspicious Discovery Related Windows API Functions | Low | Elastic TOML |
splunk/security_content
2 rules| Detection | Severity | Format |
|---|---|---|
| Windows Net System Service Discovery | Undefined | SPL |
| Windows WinPEAS PowerShell Script Execution | Undefined | SPL |
chronicle/detection-rules
1 rule| Detection | Severity | Format |
|---|---|---|
| ursnif_trojan_detection_cmd_obfuscation | Undefined | YARA-L |