T1007 System Service Discovery
EnterpriseAdversaries may try to gather information about registered local system services. Adversaries may obtain information about services using tools as well as OS utility commands such as <code>sc query</code>, <code>tasklist /svc</code>, <code>systemctl --type=service</code>, and <code>net start</code>. Adversaries may also gather information about schedule tasks via commands such as `schtasks` on Windows or `crontab -l` on Linux and macOS. Adversaries may use the information from System Service Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
platforms
Platforms this applies to.
tactics
ATT&CK tactics this technique serves.
detected by (2)
Data components that detect this.
countered by (D3FEND)
D3FEND countermeasures that counter this.
known-exploited CVEs (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2019-1653US | high7.5OT critical | KEV | ||
A vulnerability in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an unauthenticated, remote attacker to retrie… | ||||
attack patterns (1)
CAPEC attack patterns that exploit this.
groups (16)
Threat groups associated with this.
software (52)
Malware and tools associated with this.
campaigns (2)
Campaigns that use this.
Detected by (Sigma) (11)
Sigma detection rules related to this.
source
Where this definition is published.