Technique:  System Service Discovery
It actors used the following command following exploitation of a machine with LOWBALL malware to obtain information about services: net start >> %temp%\download
It used the commands net start and tasklist to get a listing of the services on the system.
It has attempted to discover services for third party EDR products.
Babuk can enumerate all services running on a compromised host.
BBSRAT can query service configuration information.
BitPaymer can enumerate existing Windows services on the host that are configured to run as LocalSystem.
Black Basta can check whether the service name FAX is present.
It has used TROJ_GETVERSION to discover system services.
Caterpillar WebShell can obtain a list of the services from a system.
It has used net start and net use for system service discovery.
Cobalt Strike can enumerate services on compromised hosts.
Comnie runs the command: net start >> %TEMP%\info.dat on a victim.
Cuba can query service status using QueryServiceStatusEx function.
DarkTortilla can retrieve information about a compromised system's running services.
Dyre has the ability to identify running services on a compromised host.
It has used Tasklist to obtain information from a compromised host.
Elise executes net start after initial communication is made to the remote server.
Emissary has the capability to execute the command net start to interact with services.
Epic uses the tasklist /svc command to list the services on the system.
GeminiDuke collects information on programs and services on the victim that are configured to automatically run at startup.
GravityRAT has a feature to list the available services on the system.
GreyEnergy enumerates all Windows services.
Heyoka Backdoor can check if it is running as a service on a compromised host.
HotCroissant has the ability to retrieve a list of services on the infected host.
Hydraq creates a backdoor through which remote attackers can monitor services.
HyperBro can list all services and their configurations.
It has used the win32_service WMI class to retrieve a list of services from the system.
InvisiMole can obtain running services on the victim.
Ixeshe can list running services.
JPIN can list running services.
jRAT can list local services.
It performs service discovery using net start commands.
It has used an instrumentor script to gather the names of all services running on a victim's system.
Kwampirs collects a list of running services with the command tasklist /svc.
LookBack can enumerate services on the victim machine.
The net start command can be used in Net to find information about Windows services.
It has used sc query on a victim to gather information about services.
During Operation CuckooBees, the threat actors used the net start command as part of their initial reconnaissance.
During Operation Wocao, threat actors used the tasklist command to search for one of its backdoors.
After compromising a victim, It discovers all running services.
PoshC2 can enumerate service and service permission information.
RainyDay can create and register a service for execution.
RATANKBA uses tasklist /svc to display running tasks.
REvil can enumerate active services.
S-Type runs the command net start on a victim.
Sardonic has the ability to execute the net start command.
SILENTTRINITY can search for modifiable services that could be used for privilege escalation.
SLOTHFULMEDIA has the capability to enumerate services.
SombRAT can enumerate services on a victim machine.
SUNBURST collected a list of service names that were hashed using a FNV-1a + XOR algorithm to check against similarly-hashed hardcoded blocklists.
Sykipot may use net start to display running services.
SynAck enumerates all running services.
SysUpdate can collect a list of services on a victim machine.
Tasklist can be used to discover services running on a system.
It has searched for services such as Alibaba Cloud Security's aliyun service and BMC Helix Cloud Security's bmc-agent service in order to disable them.
TrickBot collects a list of install programs and services on the system’s machine.
It surveys a system upon check-in to discover running services and associated processes using the tasklist /svc command.
Ursnif has gathered information about running services.
Volgmer queries the system to identify existing services.
WINERACK can enumerate services.
ZLib has the ability to discover and manipulate Windows services.
ZxShell can check the services on the system.