Description
Adversaries may try to gather information about registered local system services. Adversaries may obtain information about services using tools as well as OS utility commands such as sc query, tasklist /svc, systemctl --type=service, and net start. Adversaries may also gather information about schedule tasks via commands such as schtasks on Windows or crontab -l on Linux and macOS.(Citation: Elastic Security Labs GOSAR 2024)(Citation: SentinelLabs macOS Malware 2021)(Citation: Splunk Linux Gormir 2024)(Citation: Aquasec Kinsing 2020)
Adversaries may use the information from System Service Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Platforms
Threat Groups (15)
| ID | Group | Context |
|---|---|---|
| G0119 | Indrik Spider | [Indrik Spider](https://attack.mitre.org/groups/G0119) has used the win32_service WMI class to retrieve a list of services from the system.(Citation: ... |
| G0094 | Kimsuky | [Kimsuky](https://attack.mitre.org/groups/G0094) has used an instrumentor script to gather the names of all services running on a victim's system.(Cit... |
| G0018 | admin@338 | [admin@338](https://attack.mitre.org/groups/G0018) actors used the following command following exploitation of a machine with [LOWBALL](https://attack... |
| G1017 | Volt Typhoon | [Volt Typhoon](https://attack.mitre.org/groups/G1017) has used `net start` to list running services.(Citation: CISA AA24-038A PRC Critical Infrastruct... |
| G0139 | TeamTNT | [TeamTNT](https://attack.mitre.org/groups/G0139) has searched for services such as Alibaba Cloud Security's aliyun service and BMC Helix Cloud Securit... |
| G0049 | OilRig | [OilRig](https://attack.mitre.org/groups/G0049) has used <code>sc query</code> on a victim to gather information about services.(Citation: Palo Alto O... |
| G0143 | Aquatic Panda | [Aquatic Panda](https://attack.mitre.org/groups/G0143) has attempted to discover services for third party EDR products.(Citation: CrowdStrike AQUATIC ... |
| G0004 | Ke3chang | [Ke3chang](https://attack.mitre.org/groups/G0004) performs service discovery using <code>net start</code> commands.(Citation: Mandiant Operation Ke3ch... |
| G0006 | APT1 | [APT1](https://attack.mitre.org/groups/G0006) used the commands <code>net start</code> and <code>tasklist</code> to get a listing of the services on t... |
| G0010 | Turla | [Turla](https://attack.mitre.org/groups/G0010) surveys a system upon check-in to discover running services and associated processes using the <code>ta... |
| G0033 | Poseidon Group | After compromising a victim, [Poseidon Group](https://attack.mitre.org/groups/G0033) discovers all running services.(Citation: Kaspersky Poseidon Grou... |
| G0114 | Chimera | [Chimera](https://attack.mitre.org/groups/G0114) has used <code>net start</code> and <code>net use</code> for system service discovery.(Citation: NCC ... |
| G1054 | MirrorFace | [MirrorFace](https://attack.mitre.org/groups/G1054) has used [Tasklist](https://attack.mitre.org/software/S0057) for discovery post compromise.(Citati... |
| G0060 | BRONZE BUTLER | [BRONZE BUTLER](https://attack.mitre.org/groups/G0060) has used TROJ_GETVERSION to discover system services.(Citation: Trend Micro Tick November 2019) |
| G1006 | Earth Lusca | [Earth Lusca](https://attack.mitre.org/groups/G1006) has used [Tasklist](https://attack.mitre.org/software/S0057) to obtain information from a comprom... |
Associated Software (52)
| ID | Name | Type | Context |
|---|---|---|---|
| S0266 | TrickBot | Malware | [TrickBot](https://attack.mitre.org/software/S0266) collects a list of install programs and services on the system’s machine.(Citation: S2 Grupo Trick... |
| S0242 | SynAck | Malware | [SynAck](https://attack.mitre.org/software/S0242) enumerates all running services.(Citation: SecureList SynAck Doppelgänging May 2018)(Citation: Kaspe... |
| S1085 | Sardonic | Malware | [Sardonic](https://attack.mitre.org/software/S1085) has the ability to execute the `net start` command.(Citation: Bitdefender Sardonic Aug 2021) |
| S0082 | Emissary | Malware | [Emissary](https://attack.mitre.org/software/S0082) has the capability to execute the command <code>net start</code> to interact with services.(Citati... |
| S0386 | Ursnif | Malware | [Ursnif](https://attack.mitre.org/software/S0386) has gathered information about running services.(Citation: TrendMicro Ursnif Mar 2015) |
| S0086 | ZLib | Malware | [ZLib](https://attack.mitre.org/software/S0086) has the ability to discover and manipulate Windows services.(Citation: Cylance Dust Storm) |
| S0049 | GeminiDuke | Malware | [GeminiDuke](https://attack.mitre.org/software/S0049) collects information on programs and services on the victim that are configured to automatically... |
| S0237 | GravityRAT | Malware | [GravityRAT](https://attack.mitre.org/software/S0237) has a feature to list the available services on the system.(Citation: Talos GravityRAT) |
| S1244 | Medusa Ransomware | Malware | [Medusa Ransomware](https://attack.mitre.org/software/S1244) has leveraged an encoded list of services that it designates for termination.(Citation: P... |
| S0629 | RainyDay | Malware | [RainyDay](https://attack.mitre.org/software/S0629) can create and register a service for execution.(Citation: Bitdefender Naikon April 2021) |
| S0342 | GreyEnergy | Malware | [GreyEnergy](https://attack.mitre.org/software/S0342) enumerates all Windows services.(Citation: ESET GreyEnergy Oct 2018) |
| S1228 | PUBLOAD | Malware | [PUBLOAD](https://attack.mitre.org/software/S1228) has leveraged `tasklist` to gather running services on victim host.(Citation: Trend Micro MUSTANG P... |
| S0615 | SombRAT | Malware | [SombRAT](https://attack.mitre.org/software/S0615) can enumerate services on a victim machine.(Citation: BlackBerry CostaRicto November 2020) |
| S0260 | InvisiMole | Malware | [InvisiMole](https://attack.mitre.org/software/S0260) can obtain running services on the victim.(Citation: ESET InvisiMole June 2018) |
| S0180 | Volgmer | Malware | [Volgmer](https://attack.mitre.org/software/S0180) queries the system to identify existing services.(Citation: US-CERT Volgmer Nov 2017) |
| S0219 | WINERACK | Malware | [WINERACK](https://attack.mitre.org/software/S0219) can enumerate services.(Citation: FireEye APT37 Feb 2018) |
| S0398 | HyperBro | Malware | [HyperBro](https://attack.mitre.org/software/S0398) can list all services and their configurations.(Citation: Unit42 Emissary Panda May 2019) |
| S1066 | DarkTortilla | Malware | [DarkTortilla](https://attack.mitre.org/software/S1066) can retrieve information about a compromised system's running services.(Citation: Secureworks ... |
| S0638 | Babuk | Malware | [Babuk](https://attack.mitre.org/software/S0638) can enumerate all services running on a compromised host.(Citation: McAfee Babuk February 2021) |
| S0024 | Dyre | Malware | [Dyre](https://attack.mitre.org/software/S0024) has the ability to identify running services on a compromised host.(Citation: Malwarebytes Dyreza Nove... |
References
- Gal Singer. (2020, April 3). Threat Alert: Kinsing Malware Attacks Targeting Container Environments. Retrieved May 22, 2025.
- Jia Yu Chan, Salim Bitam, Daniel Stepanic, and Seth Goodwin. (2024, December 12). Under the SADBRIDGE with GOSAR: QUASAR Gets a Golang Rewrite. Retrieved May 22, 2025.
- Phil Stokes. (2021, February 16). 20 Common Tools & Techniques Used by macOS Threat Actors & Malware. Retrieved May 22, 2025.
- Splunk Threat Research Team , Teoderick Contreras. (2024, July 15). Breaking Down Linux.Gomir: Understanding this Backdoor’s TTPs. Retrieved May 22, 2025.
Frequently Asked Questions
What is T1007 (System Service Discovery)?
T1007 is a MITRE ATT&CK technique named 'System Service Discovery'. It belongs to the Discovery tactic(s). Adversaries may try to gather information about registered local system services. Adversaries may obtain information about services using tools as well as OS utility commands such as <code>sc query</c...
How can T1007 be detected?
Detection of T1007 (System Service Discovery) typically involves monitoring system logs, network traffic, and endpoint telemetry. Use SIEM rules, EDR solutions, and behavioral analytics to identify suspicious activity associated with this technique.
What mitigations exist for T1007?
Follow defense-in-depth principles including network segmentation, least privilege access, security monitoring, and regular patching to reduce the risk of this technique.
Which threat groups use T1007?
Known threat groups using T1007 include: Indrik Spider, Kimsuky, admin@338, Volt Typhoon, TeamTNT, OilRig, Aquatic Panda, Ke3chang.