ATT&CK

Threat actorsMITRE ATT&CK intrusion sets Malware & toolsSoftware families & tooling TechniquesTactics & techniques

ReportsPublished APT reporting SourcesEvery feed behind the archive

Developers

JSON APIFree CORS-enabled endpoints MCP serverModel Context Protocol access Source codeThis project on GitHub

Loading the archive…

Open Threat Intel Archive

Indicators are treated as facts and kept with their source_vendor, source URL, and dates; every feed is credited and redistribution-restricted feeds are flagged, not dropped. ATT&CK content is © MITRE, used under its terms. See NOTICE. The archive reports intelligence; it does not editorialize threat.

Indicators Actors Sources API GitHub

Open Threat Intel Archive

← Techniques

T1007technique

System Service Discovery

Tactics: discovery

Adversaries may try to gather information about registered local system services. Adversaries may obtain information about services using tools as well as OS utility commands such as <code>sc query</code>, <code>tasklist /svc</code>, <code>systemctl --type=service</code>, and <code>net start</code>. Adversaries may also gather information about schedule tasks via commands such as schtasks on Windows or crontab -l on Linux and macOS. Adversaries may use the information from System Service Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.

MITRE ATT&CK ↗

Linked entities · 24

uses byG0119Indrik Spider uses byG0094Kimsuky uses byG0018admin@338 uses byG1017Volt Typhoon uses byG0139TeamTNT uses byG0049OilRig uses byG0143Aquatic Panda uses byG0004Ke3chang uses byG0006APT1 uses byG0010Turla uses byG0033Poseidon Group uses byG0114Chimera uses byG1054MirrorFace uses byG0060BRONZE BUTLER uses byG1006Earth Lusca uses byS0266TrickBot uses byS0242SynAck uses byS1085Sardonic uses byS0082Emissary uses byS0386Ursnif uses byS0086ZLib uses byS0049GeminiDuke uses byS0237GravityRAT uses byS1244Medusa Ransomware