Security ArtifactsDFIR Intelligence
SearchSign inSubscribe

T1007

System Service Discovery

Linux · macOS · Windowsnothing on this site yetT1007 on attack.mitre.org

Adversaries may try to gather information about registered local system services. Adversaries may obtain information about services using tools as well as OS utility commands such as `sc query`, `tasklist /svc`, `systemctl --type=service`, and `net start`. Adversaries may also gather information about schedule tasks via commands such as `schtasks` on Windows or `crontab -l` on Linux and macOS.

MITRE ATT&CK 19.2, retrieved 2026-09-12

how MITRE says to see it

Detection of System Service Discovery Commands Across OS Platforms

  • Enumeration of services via native CLI tools (e.g., `sc query`, `tasklist /svc`, `net start`) or API calls via PowerShell and WMI.
  • Execution of service management commands like `systemctl list-units`, `service --status-all`, or direct reading of `/etc/init.d`.
  • Discovery via launchctl commands, or process enumeration using `ps aux | grep com.apple.` to identify daemons and services.

The description, detection analytics and mitigations are reproduced from MITRE ATT&CK, version 19.2, under its terms of use. The checklists, hunts, labs and everything else linked here are this site’s.