Procedure examples

TrickBot collects a list of install programs and services on the system’s machine.

SynAck enumerates all running services.

Sardonic has the ability to execute the `net start` command.

Emissary has the capability to execute the command net start to interact with services.

Ursnif has gathered information about running services.

ZLib has the ability to discover and manipulate Windows services.

GeminiDuke collects information on programs and services on the victim that are configured to automatically run at startup.

GravityRAT has a feature to list the available services on the system.

Medusa Ransomware has leveraged an encoded list of services that it designates for termination.

RainyDay can create and register a service for execution.

GreyEnergy enumerates all Windows services.

PUBLOAD has leveraged `tasklist` to gather running services on victim host.

SombRAT can enumerate services on a victim machine.

InvisiMole can obtain running services on the victim.

Volgmer queries the system to identify existing services.

WINERACK can enumerate services.

HyperBro can list all services and their configurations.

DarkTortilla can retrieve information about a compromised system's running services.

Babuk can enumerate all services running on a compromised host.

Dyre has the ability to identify running services on a compromised host.

BBSRAT can query service configuration information.

S-Type runs the command net start on a victim.

Sykipot may use net start to display running services.

Epic uses the tasklist /svc command to list the services on the system.

Cuba can query service status using QueryServiceStatusEx function.

Hydraq creates a backdoor through which remote attackers can monitor services.

Caterpillar WebShell can obtain a list of the services from a system.

Elise executes net start after initial communication is made to the remote server.

Embargo has obtained active services running on the victim’s system through the functions `OpenSCManagerW()` and `EnumServicesStatusExW()`.

Ixeshe can list running services.

Black Basta can check whether the service name `FAX` is present.

RATANKBA uses tasklist /svc to display running tasks.

Cobalt Strike can enumerate services on compromised hosts.

SUNBURST collected a list of service names that were hashed using a FNV-1a + XOR algorithm to check against similarly-hashed hardcoded blocklists.

HotCroissant has the ability to retrieve a list of services on the infected host.

REvil can enumerate active services.

SysUpdate can collect a list of services on a victim machine.

Kwampirs collects a list of running services with the command tasklist /svc.

LAMEHUG can gather service information on targeted systems.

LookBack can enumerate services on the victim machine.

ZxShell can check the services on the system.

JPIN can list running services.

Heyoka Backdoor can check if it is running as a service on a compromised host.

Qilin can identify specific services for termination or to be left running at execution.

jRAT can list local services.

Comnie runs the command: net start >> %TEMP%\info.dat on a victim.

BitPaymer can enumerate existing Windows services on the host that are configured to run as LocalSystem.

SLOTHFULMEDIA has the capability to enumerate services.

The net start command can be used in Net to find information about Windows services.

SILENTTRINITY can search for modifiable services that could be used for privilege escalation.