Skip to content

T1007 System Service Discovery

Adversaries may try to gather information about registered local system services. Adversaries may obtain information about services using tools as well as OS utility commands such as sc query, tasklist /svc, systemctl –type=service, and net start. Adversaries may also gather information about schedule tasks via commands such as schtasks on Windows or crontab -l on Linux and macOS.2341

Adversaries may use the information from System Service Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.

Item Value
ID T1007
Sub-techniques
Tactics TA0007
Platforms Linux, Windows, macOS
Version 1.6
Created 31 May 2017
Last Modified 24 October 2025

Procedure Examples

ID Name Description
G0018 admin@338 admin@338 actors used the following command following exploitation of a machine with LOWBALL malware to obtain information about services: net start >> %temp%\download72
G0006 APT1 APT1 used the commands net start and tasklist to get a listing of the services on the system.73
G0143 Aquatic Panda Aquatic Panda has attempted to discover services for third party EDR products.65
S0638 Babuk Babuk can enumerate all services running on a compromised host.50
S0127 BBSRAT BBSRAT can query service configuration information.21
S0570 BitPaymer BitPaymer can enumerate existing Windows services on the host that are configured to run as LocalSystem.55
S1070 Black Basta Black Basta can check whether the service name FAX is present.35
G0060 BRONZE BUTLER BRONZE BUTLER has used TROJ_GETVERSION to discover system services.61
S0572 Caterpillar WebShell Caterpillar WebShell can obtain a list of the services from a system.30
G0114 Chimera Chimera has used net start and net use for system service discovery.68
S0154 Cobalt Strike Cobalt Strike can enumerate services on compromised hosts.23
S0244 Comnie Comnie runs the command: net start >> %TEMP%\info.dat on a victim.11
S0625 Cuba Cuba can query service status using QueryServiceStatusEx function.41
S1066 DarkTortilla DarkTortilla can retrieve information about a compromised system’s running services.48
S0024 Dyre Dyre has the ability to identify running services on a compromised host.59
G1006 Earth Lusca Earth Lusca has used Tasklist to obtain information from a compromised host.70
S0081 Elise Elise executes net start after initial communication is made to the remote server.13
S1247 Embargo Embargo has obtained active services running on the victim’s system through the functions OpenSCManagerW() and EnumServicesStatusExW().36
S0082 Emissary Emissary has the capability to execute the command net start to interact with services.49
S0091 Epic Epic uses the tasklist /svc command to list the services on the system.54
S0049 GeminiDuke GeminiDuke collects information on programs and services on the victim that are configured to automatically run at startup.47
S0237 GravityRAT GravityRAT has a feature to list the available services on the system.39
S0342 GreyEnergy GreyEnergy enumerates all Windows services.32
S1027 Heyoka Backdoor Heyoka Backdoor can check if it is running as a service on a compromised host.26
S0431 HotCroissant HotCroissant has the ability to retrieve a list of services on the infected host.45
S0203 Hydraq Hydraq creates a backdoor through which remote attackers can monitor services.3738
S0398 HyperBro HyperBro can list all services and their configurations.34
G0119 Indrik Spider Indrik Spider has used the win32_service WMI class to retrieve a list of services from the system.63
S0260 InvisiMole InvisiMole can obtain running services on the victim.31
S0015 Ixeshe Ixeshe can list running services.51
S0201 JPIN JPIN can list running services.58
S0283 jRAT jRAT can list local services.19
G0004 Ke3chang Ke3chang performs service discovery using net start commands.69
G0094 Kimsuky Kimsuky has used an instrumentor script to gather the names of all services running on a victim’s system.67
S0236 Kwampirs Kwampirs collects a list of running services with the command tasklist /svc.18
S0582 LookBack LookBack can enumerate services on the victim machine.25
S1244 Medusa Ransomware Medusa Ransomware has leveraged an encoded list of services that it designates for termination.151617
S0039 Net The net start command can be used in Net to find information about Windows services.5
G0049 OilRig OilRig has used sc query on a victim to gather information about services.64
C0012 Operation CuckooBees During Operation CuckooBees, the threat actors used the net start command as part of their initial reconnaissance.75
C0014 Operation Wocao During Operation Wocao, threat actors used the tasklist command to search for one of its backdoors.74
G0033 Poseidon Group After compromising a victim, Poseidon Group discovers all running services.66
S0378 PoshC2 PoshC2 can enumerate service and service permission information.6
S1228 PUBLOAD PUBLOAD has leveraged tasklist to gather running services on victim host.57
S1242 Qilin Qilin can identify specific services for termination or to be left running at execution.282927
S0629 RainyDay RainyDay can create and register a service for execution.22
S0241 RATANKBA RATANKBA uses tasklist /svc to display running tasks.20
S0496 REvil REvil can enumerate active services.40
S0085 S-Type S-Type runs the command net start on a victim.46
S1085 Sardonic Sardonic has the ability to execute the net start command.44
S0692 SILENTTRINITY SILENTTRINITY can search for modifiable services that could be used for privilege escalation.8
S0533 SLOTHFULMEDIA SLOTHFULMEDIA has the capability to enumerate services.14
S0615 SombRAT SombRAT can enumerate services on a victim machine.52
S0559 SUNBURST SUNBURST collected a list of service names that were hashed using a FNV-1a + XOR algorithm to check against similarly-hashed hardcoded blocklists.33
S0018 Sykipot Sykipot may use net start to display running services.10
S0242 SynAck SynAck enumerates all running services.4243
S0663 SysUpdate SysUpdate can collect a list of services on a victim machine.12
S0057 Tasklist Tasklist can be used to discover services running on a system.7
G0139 TeamTNT TeamTNT has searched for services such as Alibaba Cloud Security’s aliyun service and BMC Helix Cloud Security’s bmc-agent service in order to disable them.62
S0266 TrickBot TrickBot collects a list of install programs and services on the system’s machine.56
G0010 Turla Turla surveys a system upon check-in to discover running services and associated processes using the tasklist /svc command.54
S0386 Ursnif Ursnif has gathered information about running services.9
S0180 Volgmer Volgmer queries the system to identify existing services.24
G1017 Volt Typhoon Volt Typhoon has used net start to list running services.71
S0219 WINERACK WINERACK can enumerate services.53
S0086 ZLib ZLib has the ability to discover and manipulate Windows services.46
S0412 ZxShell ZxShell can check the services on the system.60

References

  1. Gal Singer. (2020, April 3). Threat Alert: Kinsing Malware Attacks Targeting Container Environments. Retrieved May 22, 2025. ↩

  2. Jia Yu Chan, Salim Bitam, Daniel Stepanic, and Seth Goodwin. (2024, December 12). Under the SADBRIDGE with GOSAR: QUASAR Gets a Golang Rewrite. Retrieved May 22, 2025. ↩

  3. Phil Stokes. (2021, February 16). 20 Common Tools & Techniques Used by macOS Threat Actors & Malware. Retrieved May 22, 2025. ↩

  4. Splunk Threat Research Team , Teoderick Contreras. (2024, July 15). Breaking Down Linux.Gomir: Understanding this Backdoor’s TTPs. Retrieved May 22, 2025. ↩

  5. Savill, J. (1999, March 4). Net.exe reference. Retrieved September 22, 2015. ↩

  6. Nettitude. (2018, July 23). Python Server for PoshC2. Retrieved April 23, 2019. ↩

  7. Microsoft. (n.d.). Tasklist. Retrieved December 23, 2015. ↩

  8. Salvati, M. (2019, August 6). SILENTTRINITY Modules. Retrieved March 24, 2022. ↩

  9. Caragay, R. (2015, March 26). URSNIF: The Multifaceted Malware. Retrieved June 5, 2019. ↩

  10. Blasco, J. (2011, December 12). Another Sykipot sample likely targeting US federal agencies. Retrieved March 28, 2016. ↩

  11. Grunzweig, J. (2018, January 31). Comnie Continues to Target Organizations in East Asia. Retrieved June 7, 2018. ↩

  12. Daniel Lunghi. (2023, March 1). Iron Tiger’s SysUpdate Reappears, Adds Linux Targeting. Retrieved March 20, 2023. ↩

  13. Falcone, R., et al.. (2015, June 16). Operation Lotus Blossom. Retrieved February 15, 2016. ↩

  14. DHS/CISA, Cyber National Mission Force. (2020, October 1). Malware Analysis Report (MAR) MAR-10303705-1.v1 – Remote Access Trojan: SLOTHFULMEDIA. Retrieved October 2, 2020. ↩

  15. Anthony Galiette, Doel Santos. (2024, January 11). Medusa Ransomware Turning Your Files into Stone. Retrieved October 15, 2025. ↩

  16. Threat Hunter Team Symantec and Carbon Black. (2025, March 6). Medusa Ransomware Activity Continues to Increase. Retrieved October 15, 2025. ↩

  17. Vlad Pasca. (2024, January 1). A Deep Dive into Medusa Ransomware. Retrieved October 15, 2025. ↩

  18. Symantec Security Response Attack Investigation Team. (2018, April 23). New Orangeworm attack group targets the healthcare sector in the U.S., Europe, and Asia. Retrieved May 8, 2018. ↩

  19. Kamluk, V. & Gostev, A. (2016, February). Adwind - A Cross-Platform RAT. Retrieved April 23, 2019. ↩

  20. Trend Micro. (2017, February 27). RATANKBA: Delving into Large-scale Watering Holes against Enterprises. Retrieved May 22, 2018. ↩

  21. Lee, B. Grunzweig, J. (2015, December 22). BBSRAT Attacks Targeting Russian Organizations Linked to Roaming Tiger. Retrieved August 19, 2016. ↩

  22. Vrabie, V. (2021, April 23). NAIKON – Traces from a Military Cyber-Espionage Operation. Retrieved June 29, 2021. ↩

  23. Strategic Cyber LLC. (2020, November 5). Cobalt Strike: Advanced Threat Tactics for Penetration Testers. Retrieved April 13, 2021. ↩

  24. US-CERT. (2017, November 22). Alert (TA17-318B): HIDDEN COBRA – North Korean Trojan: Volgmer. Retrieved December 7, 2017. ↩

  25. Raggi, M. Schwarz, D.. (2019, August 1). LookBack Malware Targets the United States Utilities Sector with Phishing Attacks Impersonating Engineering Licensing Boards. Retrieved February 25, 2021. ↩

  26. Chen, Joey. (2022, June 9). Aoqin Dragon | Newly-Discovered Chinese-linked APT Has Been Quietly Spying On Organizations For 10 Years. Retrieved July 14, 2022. ↩

  27. Health Sector Cybersecurity Coordination Center. (2024, June 18). Qilin, aka Agenda Ransomware. Retrieved September 26, 2025. ↩

  28. Magdy, S. et al. (2022, August 25). New Golang Ransomware Agenda Customizes Attacks. Retrieved September 26, 2025. ↩

  29. SentinelOne. (2022, November 30). Agenda (Qilin). Retrieved September 26, 2025. ↩

  30. ClearSky Cyber Security. (2021, January). “Lebanese Cedar” APT Global Lebanese Espionage Campaign Leveraging Web Servers. Retrieved February 10, 2021. ↩

  31. Hromcová, Z. (2018, June 07). InvisiMole: Surprisingly equipped spyware, undercover since 2013. Retrieved July 10, 2018. ↩

  32. Cherepanov, A. (2018, October). GREYENERGY A successor to BlackEnergy. Retrieved November 15, 2018. ↩

  33. FireEye. (2020, December 13). Highly Evasive Attacker Leverages SolarWinds Supply Chain to Compromise Multiple Global Victims With SUNBURST Backdoor. Retrieved January 4, 2021. ↩

  34. Falcone, R. and Lancaster, T. (2019, May 28). Emissary Panda Attacks Middle East Government Sharepoint Servers. Retrieved July 9, 2019. ↩

  35. Cyble. (2022, May 6). New ransomware variant targeting high-value organizations. Retrieved November 17, 2024. ↩

  36. Cyble. (2024, May 24). The Rust Revolution: New Embargo Ransomware Steps In. Retrieved October 19, 2025. ↩

  37. Symantec Security Response. (2010, January 18). The Trojan.Hydraq Incident. Retrieved February 20, 2018. ↩

  38. Lelli, A. (2010, January 11). Trojan.Hydraq. Retrieved February 20, 2018. ↩

  39. Mercer, W., Rascagneres, P. (2018, April 26). GravityRAT - The Two-Year Evolution Of An APT Targeting India. Retrieved May 16, 2018. ↩

  40. Intel 471 Malware Intelligence team. (2020, March 31). REvil Ransomware-as-a-Service – An analysis of a ransomware affiliate operation. Retrieved August 4, 2020. ↩

  41. Roccio, T., et al. (2021, April). Technical Analysis of Cuba Ransomware. Retrieved June 18, 2021. ↩

  42. Ivanov, A. et al. (2018, May 7). SynAck targeted ransomware uses the Doppelgänging technique. Retrieved May 22, 2018. ↩

  43. Bettencourt, J. (2018, May 7). Kaspersky Lab finds new variant of SynAck ransomware using sophisticated Doppelgänging technique. Retrieved May 24, 2018. ↩

  44. Budaca, E., et al. (2021, August 25). FIN8 Threat Actor Goes Agile with New Sardonic Backdoor. Retrieved August 9, 2023. ↩

  45. Knight, S.. (2020, April 16). VMware Carbon Black TAU Threat Analysis: The Evolution of Lazarus. Retrieved May 1, 2020. ↩

  46. Gross, J. (2016, February 23). Operation Dust Storm. Retrieved December 22, 2021. ↩↩

  47. F-Secure Labs. (2015, September 17). The Dukes: 7 years of Russian cyberespionage. Retrieved December 10, 2015. ↩

  48. Secureworks Counter Threat Unit Research Team. (2022, August 17). DarkTortilla Malware Analysis. Retrieved November 3, 2022. ↩

  49. Falcone, R. and Miller-Osborn, J. (2016, February 3). Emissary Trojan Changelog: Did Operation Lotus Blossom Cause It to Evolve?. Retrieved February 15, 2016. ↩

  50. Mundo, A. et al. (2021, February). Technical Analysis of Babuk Ransomware. Retrieved August 11, 2021. ↩

  51. Sancho, D., et al. (2012, May 22). IXESHE An APT Campaign. Retrieved June 7, 2019. ↩

  52. The BlackBerry Research and Intelligence Team. (2020, November 12). The CostaRicto Campaign: Cyber-Espionage Outsourced. Retrieved May 24, 2021. ↩

  53. FireEye. (2018, February 20). APT37 (Reaper): The Overlooked North Korean Actor. Retrieved November 17, 2024. ↩

  54. Kaspersky Lab’s Global Research and Analysis Team. (2014, August 7). The Epic Turla Operation: Solving some of the mysteries of Snake/Uroburos. Retrieved December 11, 2014. ↩↩

  55. Frankoff, S., Hartley, B. (2018, November 14). Big Game Hunting: The Evolution of INDRIK SPIDER From Dridex Wire Fraud to BitPaymer Targeted Ransomware. Retrieved January 6, 2021. ↩

  56. Salinas, M., Holguin, J. (2017, June). Evolution of Trickbot. Retrieved July 31, 2018. ↩

  57. Lenart Bermejo, Sunny Lu, Ted Lee. (2024, September 9). Earth Preta Evolves its Attacks with New Malware and Strategies. Retrieved August 4, 2025. ↩

  58. Windows Defender Advanced Threat Hunting Team. (2016, April 29). PLATINUM: Targeted attacks in South and Southeast Asia. Retrieved February 15, 2018. ↩

  59. hasherezade. (2015, November 4). A Technical Look At Dyreza. Retrieved June 15, 2020. ↩

  60. Allievi, A., et al. (2014, October 28). Threat Spotlight: Group 72, Opening the ZxShell. Retrieved September 24, 2019. ↩

  61. Chen, J. et al. (2019, November). Operation ENDTRADE: TICK’s Multi-Stage Backdoors for Attacking Industries and Stealing Classified Data. Retrieved June 9, 2020. ↩

  62. Darin Smith. (2022, April 21). TeamTNT targeting AWS, Alibaba. Retrieved August 4, 2022. ↩

  63. Symantec Threat Intelligence. (2020, June 25). WastedLocker: Symantec Identifies Wave of Attacks Against U.S. Organizations. Retrieved May 20, 2021. ↩

  64. Falcone, R. and Lee, B.. (2016, May 26). The OilRig Campaign: Attacks on Saudi Arabian Organizations Deliver Helminth Backdoor. Retrieved May 3, 2017. ↩

  65. Wiley, B. et al. (2021, December 29). OverWatch Exposes AQUATIC PANDA in Possession of Log4Shell Exploit Tools During Hands-on Intrusion Attempt. Retrieved January 18, 2022. ↩

  66. Kaspersky Lab’s Global Research and Analysis Team. (2016, February 9). Poseidon Group: a Targeted Attack Boutique specializing in global cyber-espionage. Retrieved March 16, 2016. ↩

  67. An, J and Malhotra, A. (2021, November 10). North Korean attackers use malicious blogs to deliver malware to high-profile South Korean targets. Retrieved December 29, 2021. ↩

  68. Jansen, W . (2021, January 12). Abusing cloud services to fly under the radar. Retrieved September 12, 2024. ↩

  69. Villeneuve, N., Bennett, J. T., Moran, N., Haq, T., Scott, M., & Geers, K. (2014). OPERATION “KE3CHANG”: Targeted Attacks Against Ministries of Foreign Affairs. Retrieved November 12, 2014. ↩

  70. Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022. ↩

  71. CISA et al.. (2024, February 7). PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure. Retrieved May 15, 2024. ↩

  72. FireEye Threat Intelligence. (2015, December 1). China-based Cyber Threat Group Uses Dropbox for Malware Communications and Targets Hong Kong Media Outlets. Retrieved December 4, 2015. ↩

  73. Mandiant. (n.d.). APT1 Exposing One of China’s Cyber Espionage Units. Retrieved July 18, 2016. ↩

  74. Dantzig, M. v., Schamper, E. (2019, December 19). Operation Wocao: Shining a light on one of China’s hidden hacking groups. Retrieved October 8, 2020. ↩

  75. Cybereason Nocturnus. (2022, May 4). Operation CuckooBees: Deep-Dive into Stealthy Winnti Techniques. Retrieved September 22, 2022. ↩