System Service Discovery
Adversaries may try to gather information about registered local system services to shape follow-on behaviors. Common techniques include using sc query, tasklist /svc, net start, systemctl --type=service, and WMI queries (win32_service) to enumerate running and installed services. This reconnaissance helps adversaries identify security products to disable, lateral movement opportunities via vulnerable services, and persistence mechanisms already in place. Malware families including Ursnif, Kwampirs, Comnie, Elise, and SLOTHFULMEDIA all leverage service enumeration as part of their post-compromise discovery phase.
What is T1007 System Service Discovery?
System Service Discovery (T1007) maps to the Discovery tactic — the adversary is trying to figure out your environment in MITRE ATT&CK.
This page provides production-ready detection logic for System Service Discovery, covering the data sources and telemetry it touches: Process: Process Creation, Command: Command Execution, Microsoft Defender for Endpoint. The queries below are rated low severity at medium confidence, and ship for 7 SIEM platforms — KQL, SPL, Elastic, QRadar, Sumo, YARA-L, LogScale.
MITRE ATT&CK
- Tactic
- Discovery
- Technique
- T1007 System Service Discovery
- Canonical reference
- https://attack.mitre.org/techniques/T1007/
let ServiceDiscoveryCommands = dynamic([
"sc query", "sc.exe query",
"tasklist /svc", "tasklist.exe /svc",
"net start", "net1 start",
"win32_service", "Win32_Service",
"Get-Service", "get-service",
"systemctl --type=service", "systemctl list-units",
"service --status-all", "chkconfig --list"
]);
let ServiceDiscoveryBinaries = dynamic([
"sc.exe", "tasklist.exe", "net.exe", "net1.exe", "wmic.exe"
]);
DeviceProcessEvents
| where Timestamp > ago(24h)
| where (
(FileName in~ (ServiceDiscoveryBinaries) and ProcessCommandLine has_any ("query", "/svc", "start", "win32_service"))
or (FileName in~ ("powershell.exe", "pwsh.exe") and ProcessCommandLine has_any ("Get-Service", "Win32_Service", "win32_service"))
or (FileName in~ ("wmic.exe") and ProcessCommandLine has_any ("service", "win32_service"))
)
| extend IsScQuery = FileName =~ "sc.exe" and ProcessCommandLine has "query"
| extend IsTasklistSvc = FileName =~ "tasklist.exe" and ProcessCommandLine has "/svc"
| extend IsNetStart = FileName in~ ("net.exe", "net1.exe") and ProcessCommandLine has "start"
| extend IsWmicService = FileName =~ "wmic.exe" and ProcessCommandLine has_any ("service", "win32_service")
| extend IsPSGetService = FileName in~ ("powershell.exe", "pwsh.exe") and ProcessCommandLine has_any ("Get-Service", "Win32_Service")
| extend SuspiciousParent = InitiatingProcessFileName has_any ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe", "svchost.exe")
and not (InitiatingProcessFileName =~ "svchost.exe" and AccountName =~ "SYSTEM")
| where IsScQuery or IsTasklistSvc or IsNetStart or IsWmicService or IsPSGetService
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
InitiatingProcessFileName, InitiatingProcessCommandLine,
IsScQuery, IsTasklistSvc, IsNetStart, IsWmicService, IsPSGetService, SuspiciousParent
| sort by Timestamp descDetects system service discovery activity using Microsoft Defender for Endpoint DeviceProcessEvents. Monitors sc.exe query, tasklist /svc, net start, wmic win32_service queries, and PowerShell Get-Service calls. Flags processes launched from suspicious parent processes (script interpreters, LOLBins) that would indicate post-compromise reconnaissance rather than routine admin activity. Covers the most common service enumeration techniques observed in Ursnif, Kwampirs, Comnie, Elise, and SLOTHFULMEDIA malware families.
Data Sources
Required Tables
False Positives
- System administrators and IT staff routinely run sc query, net start, and tasklist /svc for legitimate troubleshooting and monitoring
- Remote management and monitoring (RMM) tools such as ConnectWise, Datto, N-able, and Kaseya execute service enumeration as part of inventory collection
- Software installation and configuration management tools (SCCM, Ansible, Puppet, Chef) query services to verify installation state
- Vulnerability scanners and compliance tools (Qualys, Tenable, CrowdStrike Spotlight) enumerate services as part of scheduled scans
- Endpoint detection and response (EDR) agents may themselves call WMI win32_service queries during telemetry collection
- Developer tooling and CI/CD pipeline agents querying service states during automated testing
Sigma rule & cross-platform mapping
The detection logic for System Service Discovery (T1007) above is provided in a vendor-neutral
form so you can deploy it on any SIEM. The same logic is shipped here as native
KQL (Microsoft Sentinel / Defender), SPL (Splunk), Elastic (Elastic Security (EQL)), QRadar (IBM QRadar (AQL)), Sumo (Sumo Logic CSE), YARA-L (Google Chronicle / SecOps), LogScale (CrowdStrike LogScale (CQL)) queries. In Sigma terms, this detection targets the
following logsource:
logsource:
category: process_creation
product: windowsBrowse the community-maintained Sigma rules for this technique:
Platform-specific guides for T1007
References (10)
- https://attack.mitre.org/techniques/T1007/
- https://www.elastic.co/security-labs/under-the-sadbridge-with-gosar
- https://www.sentinelone.com/labs/20-common-tools-techniques-used-by-macos-threat-actors-malware/
- https://www.splunk.com/en_us/blog/security/breaking-down-linux-gomir-understanding-this-backdoors-ttps.html
- https://www.aquasec.com/blog/threat-alert-kinsing-malware-container-vulnerability/
- https://www.symantec.com/blogs/threat-intelligence/orangeworm-targets-healthcare-us-europe-asia
- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/sc-query
- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/tasklist
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1007/T1007.md
- https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation
Testing Methodology
Validate this detection against 5 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Service Enumeration via sc query
Expected signal: Sysmon Event ID 1: Process Create with Image=sc.exe, CommandLine containing 'query type= all state= all'. Sysmon Event ID 11: File Create for %TEMP%\services_sc.txt. Security Event ID 4688 (if process creation auditing with command line enabled).
- Test 2Service Enumeration via tasklist /svc
Expected signal: Sysmon Event ID 1: Process Create with Image=tasklist.exe, CommandLine containing '/svc'. Sysmon Event ID 11: File Create for %TEMP%\services_tasklist.txt. The output maps service names to hosting process PIDs and executable paths.
- Test 3Service Enumeration via net start with output redirect
Expected signal: Sysmon Event ID 1: Process Create with Image=net.exe (or net1.exe), CommandLine containing 'start'. Sysmon Event ID 11: File Create for %TEMP%\df00tech-services.dat. Security Event ID 4688 if process auditing enabled.
- Test 4WMI Win32_Service Enumeration via PowerShell
Expected signal: Sysmon Event ID 1: Process Create with Image=powershell.exe, CommandLine containing 'Get-WmiObject' and 'Win32_Service'. PowerShell ScriptBlock Log Event ID 4104 with full command. WMI Activity Log Event ID 5857 (WMI provider load). No separate child process is created — the WMI query runs in-process.
- Test 5Linux Service Enumeration via systemctl
Expected signal: Auditd execve records for systemctl and service binaries (if auditd configured with execve rules: '-a always,exit -F arch=b64 -S execve'). Sysmon for Linux Event ID 1 (if deployed): Process Create with Image=/usr/bin/systemctl and CommandLine containing 'list-units --type=service'. File creation in /tmp for output files.
Response Playbook
Triage
- Identify the process tree: what spawned the service discovery command? Legitimate admin activity typically originates from explorer.exe, mmc.exe, or an RMM agent. Red flags include: cmd.exe/powershell.exe spawned by Office applications, wscript.exe, mshta.exe, or rundll32.exe as the grandparent
- Check the user context: is this an IT admin, service account, or a standard user who would not normally enumerate services? Pull the user's recent logon history and verify against expected working hours and source IPs
- Assess timing and frequency: a single sc query by an admin during business hours is routine. Multiple enumeration commands fired in rapid succession (within seconds) by the same process or user is a strong indicator of automated malware behavior — look for net start >> file.dat patterns consistent with Comnie and Elise malware
- Examine what the output was written to: check for redirection to temp files (e.g., >> %TEMP%\info.dat), pipes to other commands, or exfiltration shortly after enumeration using DeviceFileEvents and DeviceNetworkEvents for the same ProcessId
- Cross-reference with other discovery techniques on the same host around the same time window: T1033 (whoami), T1082 (systeminfo), T1016 (ipconfig/ifconfig), T1057 (tasklist) — service discovery is rarely done in isolation by threat actors, it is usually part of a discovery burst
- Check for security software targeting: TeamTNT and similar actors specifically enumerate services to identify and disable AV/EDR agents (aliyun, bmc-agent, Defender, CrowdStrike). Look for immediate follow-on attempts to stop or disable discovered services
Containment
- If service enumeration is confirmed as part of a broader compromise (concurrent C2, lateral movement, or credential access indicators): isolate the endpoint immediately via EDR network isolation or VLAN quarantine
- If the discovery is linked to a compromised user account: disable the account in Active Directory, revoke active sessions and tokens, and force password reset before re-enabling
- If malware is actively enumerating services prior to disabling security tools: prioritize preserving the current state of security services and alert the security platform team to watch for stop/disable commands targeting AV/EDR processes
- If WMI-based enumeration (Win32_Service) is detected: check for persistent WMI subscriptions (T1546.003) that may have been created during or after the discovery phase
- Block execution of wmic.exe, sc.exe, and tasklist.exe for non-admin users via AppLocker or WDAC policy if operationally feasible — these are rarely needed by standard users
Evidence Collection
- Process Creation Events: Sysmon Event ID 1 or Security Event ID 4688 (with command line auditing enabled in GPO: Computer Configuration > Windows Settings > Security Settings > Advanced Audit Policy > Detailed Tracking > Audit Process Creation, and 'Include command line in process creation events')
- WMI Activity Logs: Microsoft-Windows-WMI-Activity/Operational Event ID 5857 (provider load), 5860 (temporary subscription), 5861 (permanent subscription) — if Win32_Service was queried via WMI scripting
- PowerShell ScriptBlock Logs: Event ID 4104 from Microsoft-Windows-PowerShell/Operational — captures the full Get-Service or Get-WmiObject Win32_Service command with any pipeline context
- File Creation Events: Sysmon Event ID 11 — check for any file writes by the discovery process, particularly to TEMP directories (net start >> %TEMP%\*.dat is a known Comnie/Elise pattern)
- Network Events: Sysmon Event ID 3 — if service enumeration output was transmitted shortly after collection, correlate network connections from the same ProcessId or parent process
- Prefetch: C:\Windows\Prefetch\SC.EXE-*.pf, TASKLIST.EXE-*.pf, NET.EXE-*.pf, WMIC.EXE-*.pf — execution timestamps and frequency
- Event Log: System Event ID 7040/7045 — any subsequent service state changes following discovery (service disabled, service installed) would appear here
Escalation Criteria
- ! Service discovery commands spawned by a non-admin user account with no corresponding IT support ticket or change window
- ! Multiple discovery techniques executed in rapid succession (within 30 seconds) on the same host — indicates automated malware reconnaissance phase
- ! Discovery output redirected to a file that is subsequently read and deleted, or transmitted over the network — indicates active data collection for exfiltration
- ! Service enumeration followed immediately by sc stop, sc delete, net stop, or taskkill targeting security products (AV, EDR, backup agents) — escalate as active defense evasion
- ! WMI-based service enumeration (Win32_Service via wmic.exe or PowerShell) originating from a lateral movement vector (PsExec, WMI remote execution, WinRM) — indicates post-lateral-movement discovery
- ! Same discovery pattern seen across multiple endpoints within a short time window — indicates automated propagation or a worm-like component
Investigation Guide
Forensic Artifacts
- >
Prefetch files: C:\Windows\Prefetch\SC.EXE-*.pf, TASKLIST.EXE-*.pf, NET.EXE-*.pf, WMIC.EXE-*.pf — execution timestamps and count of executions - >
ShimCache / AppCompatCache: HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\AppCompatCache — records execution of sc.exe, tasklist.exe, net.exe even if process creation auditing was disabled - >
AmCache.hve: C:\Windows\AppCompat\Programs\Amcache.hve — records first execution timestamps for binaries involved in service discovery - >
BAM/DAM: HKLM\SYSTEM\CurrentControlSet\Services\bam\UserSettings\{SID} — Background Activity Moderator records recent execution of discovery binaries per user - >
WMI Repository: C:\Windows\System32\wbem\Repository — if WMI subscriptions were created post-discovery, artifacts persist here; use WMI-Forensics tooling to parse - >
Security Event Log: Event ID 4688 with command line (if process creation auditing enabled) — provides timestamped record of sc, tasklist, net, wmic execution - >
Sysmon Event ID 1: Process create events in Microsoft-Windows-Sysmon/Operational including full command line, parent process, and user - >
PowerShell ConsoleHost history: %APPDATA%\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt — if Get-Service or WMI service queries were run interactively - >
Linux: /var/log/auth.log or /var/log/secure — sudo usage for systemctl commands; bash history (~/.bash_history) for systemctl/service commands run interactively; auditd logs if configured with execve rules
Tuning Guidance
Service discovery is a high-volume technique with significant legitimate usage, making tuning essential to avoid alert fatigue. Start by building an allowlist of known-good process parent combinations: RMM agent binaries (e.g., ScreenConnect, N-central, DattoRMM agent processes) spawning sc.exe or net.exe should be excluded by parent process name and hash. Exclude specific service accounts used by monitoring and configuration management platforms from alerting, but require them to match expected parent processes — never exclude an account name alone. Use the 'suspicious parent' flag as a primary filter: service discovery from explorer.exe, cmd.exe spawned by a user, or PowerShell is common; service discovery from mshta.exe, wscript.exe, or rundll32.exe is almost always malicious. For mature environments, suppress single-fire sc query or net start events entirely and only alert on: (1) 3+ discovery commands within 5 minutes, (2) any discovery command from a script interpreter parent, or (3) discovery followed within 5 minutes by service stop/delete commands. Linux environments should monitor systemctl, service, and crontab commands via auditd execve rules or Sysmon for Linux, with similar parent-process context analysis applied.
Hunting Queries
Hunt for hosts where service discovery commands fire 3 or more times within a single hour from the same user. Legitimate admin activity rarely generates this frequency; automated malware reconnaissance typically fires multiple enumeration commands in rapid succession as part of an initial discovery burst.
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("sc.exe", "tasklist.exe", "net.exe", "net1.exe", "wmic.exe")
| where ProcessCommandLine has_any ("query", "/svc", "start", "win32_service")
| summarize DiscoveryCount=count(), UniqueCommands=dcount(ProcessCommandLine), Commands=make_set(ProcessCommandLine, 5), FirstSeen=min(Timestamp), LastSeen=max(Timestamp) by DeviceName, AccountName, bin(Timestamp, 1h)
| where DiscoveryCount >= 3
| sort by DiscoveryCount descindex=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
((Image="*\\sc.exe" AND CommandLine="*query*") OR (Image="*\\tasklist.exe" AND CommandLine="*/svc*") OR (Image="*\\net.exe" AND CommandLine="*start*") OR (Image="*\\wmic.exe" AND CommandLine="*win32_service*"))
| bucket _time span=1h
| stats count as DiscoveryCount, dc(CommandLine) as UniqueCommands, values(CommandLine) as Commands, earliest(_time) as FirstSeen, latest(_time) as LastSeen by host, User, _time
| where DiscoveryCount >= 3
| sort - DiscoveryCountHunt for service discovery commands spawned by script interpreters and LOLBins (wscript, cscript, mshta, rundll32, regsvr32, msiexec). This parent-child relationship strongly indicates malicious activity — legitimate service queries are almost never launched from these parent processes, making this a high-fidelity indicator of post-exploitation discovery.
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("sc.exe", "tasklist.exe", "net.exe", "net1.exe", "wmic.exe", "powershell.exe", "pwsh.exe")
| where ProcessCommandLine has_any ("query", "/svc", "win32_service", "Get-Service", "start")
| where InitiatingProcessFileName has_any ("wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe", "msiexec.exe", "explorer.exe")
| where InitiatingProcessFileName !in~ ("explorer.exe") or (InitiatingProcessFileName =~ "explorer.exe" and AccountName !contains "admin")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
| sort by Timestamp descindex=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
((Image="*\\sc.exe" AND CommandLine="*query*") OR (Image="*\\tasklist.exe" AND CommandLine="*/svc*") OR (Image="*\\net.exe" AND CommandLine="*start*") OR (Image="*\\wmic.exe" AND CommandLine="*win32_service*"))
(ParentImage="*\\wscript.exe" OR ParentImage="*\\cscript.exe" OR ParentImage="*\\mshta.exe" OR ParentImage="*\\rundll32.exe" OR ParentImage="*\\regsvr32.exe" OR ParentImage="*\\msiexec.exe")
| table _time, host, User, Image, CommandLine, ParentImage, ParentCommandLine
| sort - _timeHunt for service discovery followed within 5 minutes by service stop/delete, process kill, or scheduled task creation on the same host and user. This sequence — enumerate then act — is the hallmark of automated malware that maps the service landscape before disabling security tools (common in ransomware pre-staging and TeamTNT cloud intrusions).
let DiscoveryWindow = 5m;
let ServiceDiscovery = DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("sc.exe", "tasklist.exe", "net.exe", "net1.exe", "wmic.exe")
| where ProcessCommandLine has_any ("query", "/svc", "start", "win32_service")
| project DiscoveryTime=Timestamp, DeviceName, AccountName, DiscoveryCmd=ProcessCommandLine;
let FollowOnActions = DeviceProcessEvents
| where Timestamp > ago(7d)
| where ProcessCommandLine has_any ("sc stop", "sc delete", "net stop", "taskkill", "wmic process", "reg add", "schtasks /create")
| project ActionTime=Timestamp, DeviceName, AccountName, FollowOnCmd=ProcessCommandLine;
ServiceDiscovery
| join kind=inner FollowOnActions on DeviceName, AccountName
| where ActionTime > DiscoveryTime and ActionTime < (DiscoveryTime + DiscoveryWindow)
| project DiscoveryTime, ActionTime, DeviceName, AccountName, DiscoveryCmd, FollowOnCmd
| sort by DiscoveryTime descindex=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
((Image="*\\sc.exe" AND CommandLine="*query*") OR (Image="*\\tasklist.exe" AND CommandLine="*/svc*") OR (Image="*\\net.exe" AND CommandLine="*start*"))
| eval DiscoveryTime=_time, DiscoveryCmd=CommandLine, DiscoveryHost=host, DiscoveryUser=User
| append [search index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 (CommandLine="*sc stop*" OR CommandLine="*net stop*" OR CommandLine="*sc delete*" OR CommandLine="*taskkill*") | eval ActionTime=_time, ActionCmd=CommandLine, ActionHost=host, ActionUser=User]
| stats values(DiscoveryCmd) as DiscoveryCmds, values(ActionCmd) as ActionCmds, min(DiscoveryTime) as FirstDiscovery, min(ActionTime) as FirstAction by DiscoveryHost, DiscoveryUser
| where isnotnull(DiscoveryCmds) AND isnotnull(ActionCmds)
| eval TimeDelta=FirstAction - FirstDiscovery
| where TimeDelta > 0 AND TimeDelta < 300
| sort - FirstDiscoveryAtomic Red Team Tests
Executes sc query to enumerate all running Win32 services on the local system. This is the exact command observed in BRONZE BUTLER's TROJ_GETVERSION and commonly used in post-compromise discovery. The output format lists service names, display names, and current state (running/stopped) — providing an adversary with targets for potential service disabling.
Command
sc query type= all state= all > %TEMP%\services_sc.txt && type %TEMP%\services_sc.txtCleanup
del %TEMP%\services_sc.txt 2>nulExpected Telemetry
Sysmon Event ID 1: Process Create with Image=sc.exe, CommandLine containing 'query type= all state= all'. Sysmon Event ID 11: File Create for %TEMP%\services_sc.txt. Security Event ID 4688 (if process creation auditing with command line enabled).
Expected Detection
KQL: IsScQuery=true fires on sc.exe + 'query' match. SPL: IsScQuery=1, DiscoveryScore >= 1. Alert triggers on sc.exe with query parameter regardless of output redirection.
Runs tasklist with the /svc flag to list all running processes and their associated services. This is the exact command used by Kwampirs malware (Symantec Orangeworm). Unlike sc query, tasklist /svc shows the process hosting each service, helping adversaries identify which PID to target for injection or termination.
Command
tasklist /svc > %TEMP%\services_tasklist.txt && type %TEMP%\services_tasklist.txtCleanup
del %TEMP%\services_tasklist.txt 2>nulExpected Telemetry
Sysmon Event ID 1: Process Create with Image=tasklist.exe, CommandLine containing '/svc'. Sysmon Event ID 11: File Create for %TEMP%\services_tasklist.txt. The output maps service names to hosting process PIDs and executable paths.
Expected Detection
KQL: IsTasklistSvc=true fires on tasklist.exe + '/svc' match. SPL: IsTasklistSvc=1, DiscoveryScore >= 1. File creation of the output file would additionally trigger file creation monitoring.
Executes net start to enumerate running services and redirects output to a temp file — the exact behavior documented in Comnie malware ('net start >> %TEMP%\info.dat') and Sykipot. This simulates the automated collection behavior where service output is saved for later exfiltration or parsing by the malware's C2 component.
Command
net start >> %TEMP%\df00tech-services.dat && type %TEMP%\df00tech-services.datCleanup
del %TEMP%\df00tech-services.dat 2>nulExpected Telemetry
Sysmon Event ID 1: Process Create with Image=net.exe (or net1.exe), CommandLine containing 'start'. Sysmon Event ID 11: File Create for %TEMP%\df00tech-services.dat. Security Event ID 4688 if process auditing enabled.
Expected Detection
KQL: IsNetStart=true fires on net.exe/net1.exe + 'start' match. SPL: IsNetStart=1, DiscoveryScore >= 1. The file output redirection pattern additionally matches Comnie behavioral indicators.
Uses PowerShell's Get-WmiObject with Win32_Service class to enumerate all services — the technique used by Indrik Spider (WastedLocker) as documented by Symantec. WMI-based enumeration is harder to detect than command-line tools because it produces no child process for wmic.exe; the WMI query executes within the PowerShell process itself. This test also simulates PoshC2 framework service enumeration behavior.
Command
powershell.exe -NoProfile -Command "Get-WmiObject -Class Win32_Service | Select-Object Name, DisplayName, State, PathName | Format-Table -AutoSize"Expected Telemetry
Sysmon Event ID 1: Process Create with Image=powershell.exe, CommandLine containing 'Get-WmiObject' and 'Win32_Service'. PowerShell ScriptBlock Log Event ID 4104 with full command. WMI Activity Log Event ID 5857 (WMI provider load). No separate child process is created — the WMI query runs in-process.
Expected Detection
KQL: IsPSGetService=true fires on powershell.exe + 'Win32_Service' match. SPL: IsPSGetService=1, DiscoveryScore >= 1. PowerShell ScriptBlock logging (4104) captures the exact WMI class queried.
On Linux systems, enumerates all active systemd service units using systemctl. This is the technique documented in Elastic Security Labs GOSAR and Splunk Linux Gomir analysis. Adversaries use this to map running services before disabling security agents. Also runs service --status-all for compatibility with older init-based systems.
Command
systemctl list-units --type=service --state=running > /tmp/services_systemctl.txt; cat /tmp/services_systemctl.txt; service --status-all 2>/tmp/services_legacy.txt; cat /tmp/services_legacy.txtCleanup
rm -f /tmp/services_systemctl.txt /tmp/services_legacy.txtExpected Telemetry
Auditd execve records for systemctl and service binaries (if auditd configured with execve rules: '-a always,exit -F arch=b64 -S execve'). Sysmon for Linux Event ID 1 (if deployed): Process Create with Image=/usr/bin/systemctl and CommandLine containing 'list-units --type=service'. File creation in /tmp for output files.
Expected Detection
Linux-specific detection requires auditd or Sysmon for Linux telemetry. SPL query against linux_secure or syslog sourcetypes for systemctl executions by non-root users or from unusual parent processes (e.g., web server processes, cron jobs spawning systemctl).