Details
-
Type:
Task
-
Status: To Do
-
Priority:
Medium
-
Resolution: Unresolved
-
Labels:None
-
datasources:Process command-line parameters, Process monitoring
-
id:T1007
-
tactic:discovery
-
maturity:Not Tracked
Description
Adversaries may try to get information about registered services. Commands that may obtain information about services using operating system utilities are "sc," "tasklist /svc" using [Tasklist](https://attack.mitre.org/software/S0057), and "net start" using [Net](https://attack.mitre.org/software/S0039), but adversaries may also use other tools as well. Adversaries may use the information from [System Service Discovery](https://attack.mitre.org/techniques/T1007) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.