Cервис управления информационной безопасностью
Cервис управления информационной безопасностью
Поиск
Вход Регистрация
MITRE ATT&CK - Техника Исследование системных служб
EN
Риски
Каталоги
MITRE ATT&CK
Техника
Исследование системных служб
Куда я попал?
SECURITM это SGRC система, ? автоматизирующая процессы в службах информационной безопасности. SECURITM помогает построить и управлять ИСПДн, КИИ, ГИС, СМИБ/СУИБ, банковскими системами защиты.
А еще SECURITM это место для обмена опытом и наработками для служб безопасности.
Подробнее
Наш канал

Исследование системных служб

Adversaries may try to gather information about registered local system services. Adversaries may obtain information about services using tools as well as OS utility commands such as sc query, tasklist /svc, systemctl --type=service, and net start. Adversaries may use the information from System Service Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.

ID: T1007
Тактика(-и): Discovery
Платформы: Linux, Windows, macOS
Источники данных: Command: Command Execution, Process: OS API Execution, Process: Process Creation
Версия: 1.5
Дата создания: 31 May 2017
Последнее изменение: 15 Apr 2025

Примеры процедур
Название Описание
TrickBot

TrickBot collects a list of install programs and services on the system’s machine.(Citation: S2 Grupo TrickBot June 2017)
Net

The net start command can be used in Net to find information about Windows services.(Citation: Savill 1999)
SynAck

SynAck enumerates all running services.(Citation: SecureList SynAck Doppelgänging May 2018)(Citation: Kaspersky Lab SynAck May 2018)
Sardonic

Sardonic has the ability to execute the `net start` command.(Citation: Bitdefender Sardonic Aug 2021)
Emissary

Emissary has the capability to execute the command net start to interact with services.(Citation: Emissary Trojan Feb 2016)
SILENTTRINITY

SILENTTRINITY can search for modifiable services that could be used for privilege escalation.(Citation: GitHub SILENTTRINITY Modules July 2019)
Ursnif

Ursnif has gathered information about running services.(Citation: TrendMicro Ursnif Mar 2015)
ZLib

ZLib has the ability to discover and manipulate Windows services.(Citation: Cylance Dust Storm)
GeminiDuke

GeminiDuke collects information on programs and services on the victim that are configured to automatically run at startup.(Citation: F-Secure The Dukes)
GravityRAT

GravityRAT has a feature to list the available services on the system.(Citation: Talos GravityRAT)
RainyDay

RainyDay can create and register a service for execution.(Citation: Bitdefender Naikon April 2021)
Tasklist

Tasklist can be used to discover services running on a system.(Citation: Microsoft Tasklist)
GreyEnergy

GreyEnergy enumerates all Windows services.(Citation: ESET GreyEnergy Oct 2018)
SombRAT

SombRAT can enumerate services on a victim machine.(Citation: BlackBerry CostaRicto November 2020)
InvisiMole

InvisiMole can obtain running services on the victim.(Citation: ESET InvisiMole June 2018)
Volgmer

Volgmer queries the system to identify existing services.(Citation: US-CERT Volgmer Nov 2017)
WINERACK

WINERACK can enumerate services.(Citation: FireEye APT37 Feb 2018)
PoshC2

PoshC2 can enumerate service and service permission information.(Citation: GitHub PoshC2)
HyperBro

HyperBro can list all services and their configurations.(Citation: Unit42 Emissary Panda May 2019)
DarkTortilla

DarkTortilla can retrieve information about a compromised system's running services.(Citation: Secureworks DarkTortilla Aug 2022)
Babuk

Babuk can enumerate all services running on a compromised host.(Citation: McAfee Babuk February 2021)
Dyre

Dyre has the ability to identify running services on a compromised host.(Citation: Malwarebytes Dyreza November 2015)
BBSRAT

BBSRAT can query service configuration information.(Citation: Palo Alto Networks BBSRAT)
S-Type

S-Type runs the command net start on a victim.(Citation: Cylance Dust Storm)
Sykipot

Sykipot may use net start to display running services.(Citation: AlienVault Sykipot 2011)
Epic

Epic uses the tasklist /svc command to list the services on the system.(Citation: Kaspersky Turla)
Cuba

Cuba can query service status using QueryServiceStatusEx function.(Citation: McAfee Cuba April 2021)
Hydraq

Hydraq creates a backdoor through which remote attackers can monitor services.(Citation: Symantec Trojan.Hydraq Jan 2010)(Citation: Symantec Hydraq Jan 2010)
Caterpillar WebShell

Caterpillar WebShell can obtain a list of the services from a system.(Citation: ClearSky Lebanese Cedar Jan 2021)

Elise

Elise executes net start after initial communication is made to the remote server.(Citation: Lotus Blossom Jun 2015)
Ixeshe

Ixeshe can list running services.(Citation: Trend Micro IXESHE 2012)
Black Basta

Black Basta can check whether the service name `FAX` is present.(Citation: Cyble Black Basta May 2022)
RATANKBA

RATANKBA uses tasklist /svc to display running tasks.(Citation: RATANKBA)
Cobalt Strike

Cobalt Strike can enumerate services on compromised hosts.(Citation: Cobalt Strike Manual 4.3 November 2020)
SUNBURST

SUNBURST collected a list of service names that were hashed using a FNV-1a + XOR algorithm to check against similarly-hashed hardcoded blocklists.(Citation: FireEye SUNBURST Backdoor December 2020)
HotCroissant

HotCroissant has the ability to retrieve a list of services on the infected host.(Citation: Carbon Black HotCroissant April 2020)
REvil

REvil can enumerate active services.(Citation: Intel 471 REvil March 2020)
SysUpdate

SysUpdate can collect a list of services on a victim machine.(Citation: Lunghi Iron Tiger Linux)
Kwampirs

Kwampirs collects a list of running services with the command tasklist /svc.(Citation: Symantec Orangeworm April 2018)
LookBack

LookBack can enumerate services on the victim machine.(Citation: Proofpoint LookBack Malware Aug 2019)
ZxShell

ZxShell can check the services on the system.(Citation: Talos ZxShell Oct 2014)

JPIN

JPIN can list running services.(Citation: Microsoft PLATINUM April 2016)
Heyoka Backdoor

Heyoka Backdoor can check if it is running as a service on a compromised host.(Citation: SentinelOne Aoqin Dragon June 2022)
jRAT

jRAT can list local services.(Citation: Kaspersky Adwind Feb 2016)
Comnie

Comnie runs the command: net start >> %TEMP%\info.dat on a victim.(Citation: Palo Alto Comnie)
BitPaymer

BitPaymer can enumerate existing Windows services on the host that are configured to run as LocalSystem.(Citation: Crowdstrike Indrik November 2018)
SLOTHFULMEDIA

SLOTHFULMEDIA has the capability to enumerate services.(Citation: CISA MAR SLOTHFULMEDIA October 2020)
Turla

Turla surveys a system upon check-in to discover running services and associated processes using the tasklist /svc command.(Citation: Kaspersky Turla)
Operation Wocao

Operation Wocao has used the tasklist command to search for one of its backdoors.(Citation: FoxIT Wocao December 2019)
Indrik Spider

Indrik Spider has used the win32_service WMI class to retrieve a list of services from the system.(Citation: Symantec WastedLocker June 2020)

APT1

APT1 used the commands net start and tasklist to get a listing of the services on the system.(Citation: Mandiant APT1)
Aquatic Panda

Aquatic Panda has attempted to discover services for third party EDR products.(Citation: CrowdStrike AQUATIC PANDA December 2021)
BRONZE BUTLER

BRONZE BUTLER has used TROJ_GETVERSION to discover system services.(Citation: Trend Micro Tick November 2019)
Poseidon Group

After compromising a victim, Poseidon Group discovers all running services.(Citation: Kaspersky Poseidon Group)
OilRig

OilRig has used sc query on a victim to gather information about services.(Citation: Palo Alto OilRig May 2016)
Chimera

Chimera has used net start and net use for system service discovery.(Citation: NCC Group Chimera January 2021)
Volt Typhoon

Volt Typhoon has used `net start` to list running services.(Citation: CISA AA24-038A PRC Critical Infrastructure February 2024)
Kimsuky

Kimsuky has used an instrumentor script to gather the names of all services running on a victim's system.(Citation: Talos Kimsuky Nov 2021)
TeamTNT

TeamTNT has searched for services such as Alibaba Cloud Security's aliyun service and BMC Helix Cloud Security's bmc-agent service in order to disable them.(Citation: Cisco Talos Intelligence Group)
Ke3chang

Ke3chang performs service discovery using net start commands.(Citation: Mandiant Operation Ke3chang November 2014)
Earth Lusca

Earth Lusca has used Tasklist to obtain information from a compromised host.(Citation: TrendMicro EarthLusca 2022)
admin@338

admin@338 actors used the following command following exploitation of a machine with LOWBALL malware to obtain information about services: net start >> %temp%\download(Citation: FireEye admin@338)

Контрмеры
Контрмера Описание
System Service Discovery Mitigation

Identify unnecessary system utilities or potentially malicious software that may be used to acquire information about services, and audit and/or block them by using whitelisting (Citation: Beechey 2010) tools, like AppLocker, (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) or Software Restriction Policies (Citation: Corio 2008) where appropriate. (Citation: TechNet Applocker vs SRP)

Обнаружение

System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as Lateral Movement, based on the information obtained. Monitor processes and command-line arguments for actions that could be taken to gather system information related to services. Remote access tools with built-in features may interact directly with the Windows API to gather information. Information may also be acquired through Windows system management tools such as Windows Management Instrumentation and PowerShell.

Ссылки

  1. ClearSky Cyber Security. (2021, January). “Lebanese Cedar” APT Global Lebanese Espionage Campaign Leveraging Web Servers. Retrieved February 10, 2021.
  2. Secureworks Counter Threat Unit Research Team. (2022, August 17). DarkTortilla Malware Analysis. Retrieved November 3, 2022.
  4. Strategic Cyber LLC. (2020, November 5). Cobalt Strike: Advanced Threat Tactics for Penetration Testers. Retrieved April 13, 2021.
  5. Intel 471 Malware Intelligence team. (2020, March 31). REvil Ransomware-as-a-Service – An analysis of a ransomware affiliate operation. Retrieved August 4, 2020.
  6. FireEye. (2018, February 20). APT37 (Reaper): The Overlooked North Korean Actor. Retrieved November 17, 2024.
  7. US-CERT. (2017, November 22). Alert (TA17-318B): HIDDEN COBRA – North Korean Trojan: Volgmer. Retrieved December 7, 2017.
  8. Microsoft. (n.d.). Tasklist. Retrieved December 23, 2015.
  9. F-Secure Labs. (2015, September 17). The Dukes: 7 years of Russian cyberespionage. Retrieved December 10, 2015.
  10. FireEye. (2020, December 13). Highly Evasive Attacker Leverages SolarWinds Supply Chain to Compromise Multiple Global Victims With SUNBURST Backdoor. Retrieved January 4, 2021.
  11. Chen, J. et al. (2019, November). Operation ENDTRADE: TICK’s Multi-Stage Backdoors for Attacking Industries and Stealing Classified Data. Retrieved June 9, 2020.
  12. Cybereason Nocturnus. (2022, May 4). Operation CuckooBees: Deep-Dive into Stealthy Winnti Techniques. Retrieved September 22, 2022.
  13. Salvati, M. (2019, August 6). SILENTTRINITY Modules. Retrieved March 24, 2022.
  14. Wiley, B. et al. (2021, December 29). OverWatch Exposes AQUATIC PANDA in Possession of Log4Shell Exploit Tools During Hands-on Intrusion Attempt. Retrieved January 18, 2022.
  15. Lelli, A. (2010, January 11). Trojan.Hydraq. Retrieved February 20, 2018.
  16. Kaspersky Lab's Global Research and Analysis Team. (2016, February 9). Poseidon Group: a Targeted Attack Boutique specializing in global cyber-espionage. Retrieved March 16, 2016.
  17. Raggi, M. Schwarz, D.. (2019, August 1). LookBack Malware Targets the United States Utilities Sector with Phishing Attacks Impersonating Engineering Licensing Boards. Retrieved February 25, 2021.
  18. Hromcová, Z. (2018, June 07). InvisiMole: Surprisingly equipped spyware, undercover since 2013. Retrieved July 10, 2018.
  19. Falcone, R. and Miller-Osborn, J. (2016, February 3). Emissary Trojan Changelog: Did Operation Lotus Blossom Cause It to Evolve?. Retrieved February 15, 2016.
  20. Dantzig, M. v., Schamper, E. (2019, December 19). Operation Wocao: Shining a light on one of China’s hidden hacking groups. Retrieved October 8, 2020.
  21. Roccio, T., et al. (2021, April). Technical Analysis of Cuba Ransomware. Retrieved June 18, 2021.
  22. Falcone, R. and Lee, B.. (2016, May 26). The OilRig Campaign: Attacks on Saudi Arabian Organizations Deliver Helminth Backdoor. Retrieved May 3, 2017.
  23. Salinas, M., Holguin, J. (2017, June). Evolution of Trickbot. Retrieved July 31, 2018.
  24. Trend Micro. (2017, February 27). RATANKBA: Delving into Large-scale Watering Holes against Enterprises. Retrieved May 22, 2018.
  25. Vrabie, V. (2021, April 23). NAIKON – Traces from a Military Cyber-Espionage Operation. Retrieved June 29, 2021.
  26. DHS/CISA, Cyber National Mission Force. (2020, October 1). Malware Analysis Report (MAR) MAR-10303705-1.v1 – Remote Access Trojan: SLOTHFULMEDIA. Retrieved October 2, 2020.
  27. Caragay, R. (2015, March 26). URSNIF: The Multifaceted Malware. Retrieved June 5, 2019.
  28. CISA et al.. (2024, February 7). PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure. Retrieved May 15, 2024.
  29. Sancho, D., et al. (2012, May 22). IXESHE An APT Campaign. Retrieved June 7, 2019.
  30. hasherezade. (2015, November 4). A Technical Look At Dyreza. Retrieved June 15, 2020.
  31. Symantec Threat Intelligence. (2020, June 25). WastedLocker: Symantec Identifies Wave of Attacks Against U.S. Organizations. Retrieved May 20, 2021.
  32. Budaca, E., et al. (2021, August 25). FIN8 Threat Actor Goes Agile with New Sardonic Backdoor. Retrieved August 9, 2023.
  33. Jansen, W . (2021, January 12). Abusing cloud services to fly under the radar. Retrieved September 12, 2024.
  34. An, J and Malhotra, A. (2021, November 10). North Korean attackers use malicious blogs to deliver malware to high-profile South Korean targets. Retrieved December 29, 2021.
  35. Kaspersky Lab's Global Research and Analysis Team. (2014, August 7). The Epic Turla Operation: Solving some of the mysteries of Snake/Uroburos. Retrieved December 11, 2014.
  36. Falcone, R., et al.. (2015, June 16). Operation Lotus Blossom. Retrieved February 15, 2016.
  37. Lee, B. Grunzweig, J. (2015, December 22). BBSRAT Attacks Targeting Russian Organizations Linked to Roaming Tiger. Retrieved August 19, 2016.
  38. Falcone, R. and Lancaster, T. (2019, May 28). Emissary Panda Attacks Middle East Government Sharepoint Servers. Retrieved July 9, 2019.
  39. Symantec Security Response Attack Investigation Team. (2018, April 23). New Orangeworm attack group targets the healthcare sector in the U.S., Europe, and Asia. Retrieved May 8, 2018.
  40. Dantzig, M. v., Schamper, E. (2019, December 19). Operation Wocao: Shining a light on one of China’s hidden hacking groups. Retrieved October 8, 2020.
  41. Mandiant. (n.d.). APT1 Exposing One of China’s Cyber Espionage Units. Retrieved July 18, 2016.
  42. Blasco, J. (2011, December 12). Another Sykipot sample likely targeting US federal agencies. Retrieved March 28, 2016.
  43. Mercer, W., Rascagneres, P. (2018, April 26). GravityRAT - The Two-Year Evolution Of An APT Targeting India. Retrieved May 16, 2018.
  44. FireEye Threat Intelligence. (2015, December 1). China-based Cyber Threat Group Uses Dropbox for Malware Communications and Targets Hong Kong Media Outlets. Retrieved December 4, 2015.
  45. Mundo, A. et al. (2021, February). Technical Analysis of Babuk Ransomware. Retrieved August 11, 2021.
  46. Chen, Joey. (2022, June 9). Aoqin Dragon | Newly-Discovered Chinese-linked APT Has Been Quietly Spying On Organizations For 10 Years. Retrieved July 14, 2022.
  47. Symantec Security Response. (2010, January 18). The Trojan.Hydraq Incident. Retrieved February 20, 2018.
  48. Windows Defender Advanced Threat Hunting Team. (2016, April 29). PLATINUM: Targeted attacks in South and Southeast Asia. Retrieved February 15, 2018.
  49. Cherepanov, A. (2018, October). GREYENERGY A successor to BlackEnergy. Retrieved November 15, 2018.
  50. Gross, J. (2016, February 23). Operation Dust Storm. Retrieved December 22, 2021.
  51. Cyble. (2022, May 6). New ransomware variant targeting high-value organizations. Retrieved November 17, 2024.
  52. Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022.
  53. Knight, S.. (2020, April 16). VMware Carbon Black TAU Threat Analysis: The Evolution of Lazarus. Retrieved May 1, 2020.
  54. Daniel Lunghi. (2023, March 1). Iron Tiger’s SysUpdate Reappears, Adds Linux Targeting. Retrieved March 20, 2023.
  55. Nettitude. (2018, July 23). Python Server for PoshC2. Retrieved April 23, 2019.
  56. The BlackBerry Research and Intelligence Team. (2020, November 12). The CostaRicto Campaign: Cyber-Espionage Outsourced. Retrieved May 24, 2021.
  57. Grunzweig, J. (2018, January 31). Comnie Continues to Target Organizations in East Asia. Retrieved June 7, 2018.
  58. Ivanov, A. et al. (2018, May 7). SynAck targeted ransomware uses the Doppelgänging technique. Retrieved May 22, 2018.
  59. Savill, J. (1999, March 4). Net.exe reference. Retrieved September 22, 2015.
  60. Kamluk, V. & Gostev, A. (2016, February). Adwind - A Cross-Platform RAT. Retrieved April 23, 2019.
  61. Frankoff, S., Hartley, B. (2018, November 14). Big Game Hunting: The Evolution of INDRIK SPIDER From Dridex Wire Fraud to BitPaymer Targeted Ransomware. Retrieved January 6, 2021.
  62. Bettencourt, J. (2018, May 7). Kaspersky Lab finds new variant of SynAck ransomware using sophisticated Doppelgänging technique. Retrieved May 24, 2018.
  63. Allievi, A., et al. (2014, October 28). Threat Spotlight: Group 72, Opening the ZxShell. Retrieved September 24, 2019.
  64. Villeneuve, N., Bennett, J. T., Moran, N., Haq, T., Scott, M., & Geers, K. (2014). OPERATION “KE3CHANG”: Targeted Attacks Against Ministries of Foreign Affairs. Retrieved November 12, 2014.
  65. Darin Smith. (2022, April 21). TeamTNT targeting AWS, Alibaba. Retrieved August 4, 2022.
Навигация

Связанные риски

Ничего не найдено

Каталоги

Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.