MITRE ATT&CK Tactic(s): Discovery
Adversaries may try to get information about registered services. Commands that may obtain information about services using operating system utilities are "sc," "tasklist /svc" using [Tasklist](https://attack.mitre.org/software/S0057), and "net start" using [Net](https://attack.mitre.org/software/S0039), but adversaries may also use other tools as well. Adversaries may use the information from [System Service Discovery](https://attack.mitre.org/techniques/T1007) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Last accessed: May 23, 2022
Total ATT&CK-mapped resources: 2328
ATT&CK-mapped resources for this (sub)technique: 1
Resources mapped to this (sub)technique can be viewed on this page (see also the ATT&CK to D3FEND Mapper tool):
Last accessed: August 09, 2022
Total ATT&CK-mapped rules: 159
ATT&CK-mapped resources for this (sub)technique: 2
Resources mapped to this (sub)technique can be located in the following files within the repository's analytics folder:
Last accessed: August 09, 2022
Total ATT&CK-mapped rules: 2578
ATT&CK-mapped resources for this (sub)technique: 3
Resources mapped to this (sub)technique can be located in the following files within the repository's rules folder:
- windows / process_creation / Query Registry
- windows / process_creation / Net.exe Execution
- windows / process_creation / Suspicious Sc Query
Last accessed: August 10, 2022
Total ATT&CK-mapped tests: 1341
ATT&CK-mapped resources for this (sub)technique: 3
The following unit tests mapped to this (sub)technique can be located in the file here:
- System Service Discovery
- System Service Discovery - net.exe
- System Service Discovery - systemctl
Last accessed: August 10, 2022
Total ATT&CK-mapped tests: 70
ATT&CK-mapped resources for this (sub)technique: 1
Resources mapped to this (sub)technique can be located in the following files within this repository:
- Quick execution of a series of suspicious commands: 1 unit tests