T1007 — System Service Discovery

Tactic: Discovery · Platforms: Linux, macOS, Windows

Adversaries may try to gather information about registered local system services. Adversaries may obtain information about services using tools as well as OS utility commands such as sc query, tasklist /svc, systemctl --type=service, and net start. Adversaries may also gather information about…

Sigma detection rules (3)

T1007 System Service Discovery

title: T1007 System Service Discovery
id: d58a7cf1-cac5-429e-9fab-272ff72b866b
description: 'Detects System Service Discovery commands (sc query, tasklist /svc, net start with no further arguments); the previous version matched any tasklist.exe execution (overlapping Process Discovery, T1057) and any net.exe command merely containing "start" (which also matches net start <ServiceName>, an execution action rather than discovery) - both narrowed below. Tune using: ProcessName, CommandLineMatch, ParentProcess.'
references:
  - https://attack.mitre.org/techniques/T1007
author: Shahrukh Khan
date: 2026-02-15
license: MIT
tags:
  - attack.discovery
  - attack.t1007

logsource:
  category: process_creation
  product: windows
  service: sysmon

detection:
  selection_sc:
    Image|endswith: '\sc.exe'
    CommandLine|contains: 'query'

  selection_tasklist:
    Image|endswith: '\tasklist.exe'
    CommandLine|contains: '/svc'

  selection_netstart:
    Image|endswith:
      - '\net.exe'
      - '\net1.exe'
    CommandLine|endswith: ' start'

  condition: 1 of selection_*

falsepositives:
  - Routine IT administration, monitoring agents, and helpdesk troubleshooting scripts run these commands constantly.

level: informational

T1007 System Service Discovery

title: T1007 System Service Discovery
id: 6eea927f-276e-447d-8df0-211929998b3e
description: 'Detection of System Service Discovery Commands Across OS Platforms. (Retargeted to the process_creation auditd telemetry that actually captures this techniques behavior; see logsource below.) Tune using: CommandPattern, ExecutionUser, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1007
author: Shahrukh Khan
date: 2026-03-26
license: MIT
tags:
  - attack.discovery
  - attack.t1007

logsource:
  category: process_creation
  product: linux

detection:
  selection:
    type: EXECVE
    a0|endswith:
      - '/systemctl'
      - '/service'
      - '/chkconfig'
    a1|contains:
      - 'list-units'
      - 'status'
      - '--list'
  condition: selection

falsepositives:
  - Routine administrative use of systemctl/service to check running services is extremely common and not inherently malicious.

level: informational

T1007 System Service Discovery

title: T1007 System Service Discovery
id: 112c12af-92ee-4837-a35c-41cd3b5905e0
description: 'Detection of System Service Discovery Commands Across OS Platforms. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: CommandLineContent, ProcessParent.'
references:
  - https://attack.mitre.org/techniques/T1007
author: Shahrukh Khan
date: 2026-06-11
license: MIT
tags:
  - attack.discovery
  - attack.t1007

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|endswith: '/launchctl'
    CommandLine|contains: 'list'
  selection_sw:
    Image|endswith:
      - '/sw_vers'
      - '/systemsetup'
  condition: 1 of selection_*

falsepositives:
  - Routine administrative or monitoring scripts enumerating installed services and system version.

level: informational

Explore