System Service Discovery (T1007) is a discovery technique. Adversaries try to gather information about registered local system services. MITRE lists Linux, macOS and Windows.
How attackers use it
MITRE names the commands. On Windows, these include sc query, tasklist /svc and net start. On Linux, systemctl with the service type option. MITRE adds that adversaries may also gather information about scheduled tasks with schtasks on Windows or crontab -l on Linux and macOS.
The results shape what happens next. MITRE says adversaries may use this information during automated discovery to decide whether to fully infect the target and whether to try specific actions. Security tooling and databases show up in a service list, and so do interesting targets.
How to detect it
Discovery commands are normal for administrators, so context decides. MITRE's analytic covers three platforms:
- Windows: enumeration through sc query, tasklist /svc, net start, or the same information through PowerShell and WMI.
- Linux: service management commands such as systemctl list-units, service with the status option, or reading /etc/init.d directly.
- macOS: launchctl commands, or process listings used to find daemons.
Look at process creation events with command lines, and at the parent process. A service query launched by an office application or a web server process is worth a look. A service query chained with other discovery commands from the same parent in a short time is worth more.
Alerting on a single command from an administrator would drown you. Alert on bursts of discovery from non-administrative parents.
How to reduce the risk
MITRE lists no mitigations for this technique, because it abuses legitimate system features. Focus on what comes before and after: limit who can log on interactively to servers, use endpoint tools that flag unusual parent and child processes, and keep logging on.
Reading the command mix
Service discovery rarely happens alone. MITRE's examples mix service listing with scheduled task listing. On a compromised host, you often see them in a group with account discovery, network discovery and process listing. A group of discovery commands launched in short order by one parent is a pattern few administrators produce.
A tuning approach
- Collect process creation events with command lines and parent processes.
- Build a list of the commands in this family: service queries, task listings, and process listings with service detail.
- Count how many distinct commands from the list run on a host within five minutes.
- Alert when the count crosses a threshold you set from a baseline week, and add the parent process name to the alert.
Administrators will trigger it sometimes. Allow named jump hosts and management tooling, and keep the rule for everything else.
Why defenders care
Service lists also show what protects the host. If an adversary reads the services and finds your endpoint agent, they may try to turn it off. So pair this detection with an alert for a security service stopping or changing its start type. The discovery is the first step, and the tampering is the second, and the second is much easier to alert on.
Linux and macOS
On Linux, the same pattern appears as systemctl listings, service status commands and reads of init directories. On macOS it is launchctl listing and process queries for daemons. Use your audit or endpoint tool to capture those commands, with the user and parent process.
Quick check
Why does MITRE list no mitigation for this technique?
It relies on normal operating system commands that cannot be disabled without breaking administration. Detection and limiting access are the practical controls.
