Procedure examples

Indrik Spider has used the win32_service WMI class to retrieve a list of services from the system.

Kimsuky has used an instrumentor script to gather the names of all services running on a victim's system.

admin@338 actors used the following command following exploitation of a machine with LOWBALL malware to obtain information about services: net start >> %temp%\download

Volt Typhoon has used `net start` to list running services.

TeamTNT has searched for services such as Alibaba Cloud Security's aliyun service and BMC Helix Cloud Security's bmc-agent service in order to disable them.

OilRig has used sc query on a victim to gather information about services.

Aquatic Panda has attempted to discover services for third party EDR products.

Ke3chang performs service discovery using net start commands.

APT1 used the commands net start and tasklist to get a listing of the services on the system.

Turla surveys a system upon check-in to discover running services and associated processes using the tasklist /svc command.

After compromising a victim, Poseidon Group discovers all running services.

Chimera has used net start and net use for system service discovery.

MirrorFace has used Tasklist for discovery post compromise.

BRONZE BUTLER has used TROJ_GETVERSION to discover system services.

Earth Lusca has used Tasklist to obtain information from a compromised host.