Threat intelligence / Technique

System Service Discovery

Adversaries may try to gather information about registered local system services. Adversaries may obtain information about services using tools as well as OS utility commands such as sc query , tasklist /svc , systemctl --type=service , and net start . Adversaries may also gather information about schedule tasks via commands such as `schtasks` on Windows or `crontab -l` on Linux and macOS.(Citation: Elastic Security Labs GOSAR 2024)(Citation: SentinelLabs macOS Malware 2021)(Citation: Splunk Linux Gormir 2024)(Citation: Aquasec Kinsing 2020) Adversaries may use the information from [System Service Discovery](https://attack.mitre.org/techniques/T1007) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.

Technique

TypeTechnique

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

Adversaries may try to gather information about registered local system services. Adversaries may obtain information about services using tools as well as OS utility commands such as sc query , tasklist /svc , systemctl --type=service , and net start . Adversaries may also gather information about schedule tasks via commands such as `schtasks` on Windows or `crontab -l` on Linux and macOS.(Citation: Elastic Security Labs GOSAR 2024)(Citation: SentinelLabs macOS Malware 2021)(Citation: Splunk Linux Gormir 2024)(Citation: Aquasec Kinsing 2020) Adversaries may use the information from [System Service Discovery](https://attack.mitre.org/techniques/T1007) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.

70 recorded

Relationships

mapped-to

from Services Footprinting

Technique

uses

Group

uses

from APT1

Group

uses

from Aquatic Panda

Group

uses

from Babuk

Malware

uses

Malware

uses

Malware

uses

from Black Basta

Malware

uses

from BRONZE BUTLER

Group

uses

from Caterpillar WebShell

Malware

uses

Group

uses

from Cobalt Strike

Malware

uses

Malware

uses

from Cuba

Malware

uses

from DarkTortilla

Malware

uses

from Dyre

Malware

uses

from Earth Lusca

Group

uses

from Elise

Malware

uses

Malware

uses

Malware

uses

from Epic

Malware

uses

from GeminiDuke

Malware

uses

from GravityRAT

Malware

uses

from GreyEnergy

Malware

uses

from Heyoka Backdoor

Malware

uses

from HotCroissant

Malware

uses

Malware

uses

Malware

uses

from Indrik Spider

Group

uses

from InvisiMole

Malware

uses

Malware

uses

from JPIN

Malware

uses

from jRAT

Malware

uses

Group

uses

Group

uses

Malware

uses

Malware

uses

Malware

uses

from Medusa Ransomware

Malware

uses

from MirrorFace

Group

uses

from Net

Tool

uses

Group

uses

from Operation CuckooBees

Campaign

uses

from Operation Wocao

Campaign

uses

from Poseidon Group

Group

uses

Tool

uses

Malware

uses

from Qilin

Malware

uses

Malware

uses

Malware

uses

from REvil

Malware

uses

Malware

uses

from SILENTTRINITY

Tool

uses

from SLOTHFULMEDIA

Malware

uses

Malware

uses

Malware

uses

Malware

uses

Malware

uses

Malware

uses

Malware

uses

Tool

uses

Group

uses

Malware

uses

from Turla

Group

uses

Malware

uses

Malware

uses

from Volt Typhoon

Group

uses

Malware

uses

from ZLib

Malware

uses

Malware

5 external

References

mitre-attack

T1007

Aquasec Kinsing 2020

https://www.aquasec.com/blog/threat-alert-kinsing-malware-container-vulnerability/

Elastic Security Labs GOSAR 2024

https://www.elastic.co/security-labs/under-the-sadbridge-with-gosar

SentinelLabs macOS Malware 2021

https://www.sentinelone.com/labs/20-common-tools-techniques-used-by-macos-threat-actors-malware/

Splunk Linux Gormir 2024

https://www.splunk.com/en_us/blog/security/breaking-down-linux-gomir-understanding-this-backdoors-ttps.html