System Service Discovery
Adversaries may try to gather information about registered local system services. Adversaries may obtain information about services using tools as well as OS utility commands such as <code>sc query</code>, <code>tasklist /svc</code>, <code>systemctl --type=service</code>, and <code>net start</code>. Adversaries may also gather information about schedule tasks via commands such as `schtasks` on Windows or `crontab -l` on Linux and macOS.(Citation: Elastic Security Labs GOSAR 2024)(Citation: Senti...
BY SOURCE
PROCEDURES (9)
Auto-extracted: 8 detections for process creation monitoring
Auto-extracted: 1 detections for privilege
Auto-extracted: 1 detections for service
Auto-extracted: 1 detections for credential
Auto-extracted: 1 detections for powershell
Auto-extracted: 1 detections for service
Auto-extracted: 1 detections for service
Auto-extracted: 1 detections for credential
Auto-extracted: 1 detections for suspicious