Adversaries may try to gather information about registered local system services. Adversaries may obtain information about services using tools as well as OS utility commands such as <code>sc query</code>, <code>tasklist /svc</code>, <code>systemctl --type=service</code>, and <code>net start</code>. Adversaries may also gather information about schedule tasks via commands such as `schtasks` on Windows or `crontab -l` on Linux and macOS.1234 Adversaries may use the information from System Service Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
- Elastic Security Labs GOSAR 2024
- SentinelLabs macOS Malware 2021
- Splunk Linux Gormir 2024
- Aquasec Kinsing 2020
Groups using this technique
| Group | Name | Country |
|---|---|---|
| grp_g0033 | Poseidon Group | — |
| grp_g1054 | MirrorFace | — |
| grp_g0143 | Aquatic Panda | China |
| grp_g0119 | Indrik Spider | Russia |
| grp_g0004 | Ke3chang | — |
| grp_g0114 | Chimera | China |
| grp_g0018 | admin@338 | China |
| grp_g0049 | OilRig | Iran |
| grp_g0006 | APT1 | China |
| grp_g1017 | Volt Typhoon | — |
| grp_g1059 | NIMBUS MANTICORE | — |
| grp_g0010 | Turla | Russia |
| grp_g0094 | Kimsuky | DPRK |
| grp_g0139 | TeamTNT | — |
| grp_g0060 | BRONZE BUTLER | — |
| grp_g1006 | Earth Lusca | China |
Claims
No public claim points at this technique yet.
Auto-ingested and not human-reviewed; confidence and validity read by citation.