T1007_system-service-discovery

T1007 System Service Discovery

High-Level Description

Adversaries may try to gather information about registered local system services. Adversaries may obtain information about services using tools as well as OS utility commands such as sc query, tasklist /svc, systemctl --type=service, and net start. Adversaries may also gather information about schedule tasks via commands such as schtasks on Windows or crontab -l on Linux and macOS.

Adversaries may use the information from System Service Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.

Kill Chain Phase

• Discovery (TA0007)

Platforms: Linux, macOS, Windows

What to Check

• Identify if System Service Discovery technique is applicable to target environment
• Check Linux systems for indicators of System Service Discovery
• Check macOS systems for indicators of System Service Discovery
• Check Windows systems for indicators of System Service Discovery
• Assess detection coverage (1 detection strategies)

How to Test

Atomic Red Team Tests

The following tests are from Atomic Red Team and provide actionable ways to test this technique:

Atomic Test 1: System Service Discovery

Identify system services.

Upon successful execution, cmd.exe will execute service commands with expected result to stdout.

Supported Platforms: windows Elevation Required: Yes

tasklist.exe /svc
sc query
sc query state= all

Atomic Test 2: System Service Discovery - net.exe

Enumerates started system services using net.exe and writes them to a file. This technique has been used by multiple threat actors.

Upon successful execution, net.exe will run from cmd.exe that queries services. Expected output is to a txt file in in the temp directory called service-list.txt.

Supported Platforms: windows

net.exe start >> #{output_file}

Atomic Test 3: System Service Discovery - systemctl/service

Enumerates system service using systemctl/service

Supported Platforms: linux

if [ "$(uname)" = 'FreeBSD' ]; then service -e; else systemctl --type=service; fi;

Atomic Test 4: Get-Service Execution

Executes the Get-Service cmdlet to gather objects representing all services on the local system.

Supported Platforms: windows

powershell.exe Get-Service

Atomic Test 5: System Service Discovery - macOS launchctl

Enumerates services on macOS using launchctl. Used by adversaries for identifying daemons, background services, and persistence mechanisms.

Supported Platforms: macos

launchctl list

Manual Testing

If Atomic Red Team tests are not applicable, manually verify the technique by:

1. Identify Attack Surface: Determine if the target environment is susceptible to System Service Discovery by examining the target platforms (Linux, macOS, Windows).

2. Assess Existing Defenses: Review whether mitigations for T1007 are in place. If defenses are absent or misconfigured, this technique may be exploitable.

3. Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.

Remediation Guide

No specific mitigations documented for this technique.

Detection

Detection of System Service Discovery Commands Across OS Platforms

Risk Assessment

CWE Categories

References

• Aquasec Kinsing 2020
• Elastic Security Labs GOSAR 2024
• SentinelLabs macOS Malware 2021
• Splunk Linux Gormir 2024
• Atomic Red Team - T1007
• MITRE ATT&CK - T1007