T1007Discovery
System Service Discovery
Adversaries may try to gather information about registered local system services. Adversaries may obtain information about services using tools as well as OS utility commands such as sc query, tasklist /svc, systemctl --type=service, and net start. Adversaries may also gather information about schedule tasks via commands such as `schtasks` on Windows or `crontab -l` on Linux and macOS.…
CVEs1
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.1
Reports0
Detections
11 Sigma rules tagged T1007System Service DiscoveryT100711 general rules
- HackTool - PCHunter Executionhightest
- ESXi Network Configuration Discovery Via ESXCLImediumtest
- ESXi Storage Information Discovery Via ESXCLImediumtest
- ESXi System Information Discovery Via ESXCLImediumtest
- ESXi VM List Discovery Via ESXCLImediumtest
- ESXi VSAN Information Discovery Via ESXCLImediumtest
- Potential Configuration And Service Reconnaissance Via Reg.EXEmediumtest
- Potential Registry Reconnaissance Via PowerShell Scriptmediumtest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to System Service Discovery
1 CVE, by priority. Each link shows its badge.- CVE-2019-1653Cisco Small Business RV320 and RV325 Routers Information Disclosure VulnerabilityCisco · Small Business RV320 and RV325 RoutersKEVPublic exploitHigh · 7.5T1190Exploit Public-Facing ApplicationT1082System Information Discovery+2 more · 1 reportMITRE CTID mapping of the KEV entry · follow-on activity99.9%Top 0.04%72.1priority