Procedure examples

BADFLICK has uploaded files from victims' machines.

During APT28 Nearest Neighbor Campaign, APT28 accessed volume shadow copies through executing vssadmin in order to dump the NTDS.dit file.

During the 2025 Poland Wiper Attacks, the adversaries copied volume shadow copies through executing `vssadmin` in order to dump the `NTDS.dit` file.

Volt Typhoon has executed the Windows-native `vssadmin` command to create volume shadow copies.

Scattered Spider has created volume shadow copies of virtual domain controller disks to extract the `NTDS.dit` file.

esentutl can use the Volume Shadow Copy service to copy locked files such as `ntds.dit`.

During Operation CuckooBees, the threat actors used the `net start` command as part of their initial reconnaissance.

During Operation Wocao, threat actors used the `tasklist` command to search for one of its backdoors.

Indrik Spider has used the win32_service WMI class to retrieve a list of services from the system.

Kimsuky has used an instrumentor script to gather the names of all services running on a victim's system.

admin@338 actors used the following command following exploitation of a machine with LOWBALL malware to obtain information about services: net start >> %temp%\download

Volt Typhoon has used `net start` to list running services.

TeamTNT has searched for services such as Alibaba Cloud Security's aliyun service and BMC Helix Cloud Security's bmc-agent service in order to disable them.

OilRig has used sc query on a victim to gather information about services.

Aquatic Panda has attempted to discover services for third party EDR products.

Ke3chang performs service discovery using net start commands.

APT1 used the commands net start and tasklist to get a listing of the services on the system.

Turla surveys a system upon check-in to discover running services and associated processes using the tasklist /svc command.

After compromising a victim, Poseidon Group discovers all running services.

Chimera has used net start and net use for system service discovery.

MirrorFace has used Tasklist for discovery post compromise.

BRONZE BUTLER has used TROJ_GETVERSION to discover system services.

Earth Lusca has used Tasklist to obtain information from a compromised host.

TrickBot collects a list of install programs and services on the system’s machine.

SynAck enumerates all running services.

Sardonic has the ability to execute the `net start` command.

Emissary has the capability to execute the command net start to interact with services.

Ursnif has gathered information about running services.

ZLib has the ability to discover and manipulate Windows services.

GeminiDuke collects information on programs and services on the victim that are configured to automatically run at startup.

GravityRAT has a feature to list the available services on the system.

Medusa Ransomware has leveraged an encoded list of services that it designates for termination.

RainyDay can create and register a service for execution.

GreyEnergy enumerates all Windows services.

PUBLOAD has leveraged `tasklist` to gather running services on victim host.

SombRAT can enumerate services on a victim machine.

InvisiMole can obtain running services on the victim.

Volgmer queries the system to identify existing services.

WINERACK can enumerate services.

HyperBro can list all services and their configurations.

DarkTortilla can retrieve information about a compromised system's running services.

Babuk can enumerate all services running on a compromised host.

Dyre has the ability to identify running services on a compromised host.

BBSRAT can query service configuration information.

S-Type runs the command net start on a victim.

Sykipot may use net start to display running services.

Epic uses the tasklist /svc command to list the services on the system.

Cuba can query service status using QueryServiceStatusEx function.

Hydraq creates a backdoor through which remote attackers can monitor services.

Caterpillar WebShell can obtain a list of the services from a system.