1. Home
  2. Techniques
  3. Enterprise
  4. 系统服务发现

系统服务发现

ID Name
T1007.001 合法管理工具隐蔽调用
T1007.002 服务元数据碎片化采集

系统服务发现是攻击者通过查询操作系统服务配置信息来识别潜在攻击面的关键侦察技术，通常使用系统内置工具（如sc、net）或API接口获取服务状态、依赖关系和权限配置。传统检测手段主要监控异常进程创建（如未知可执行文件调用服务管理API）、可疑命令行参数（如批量服务枚举操作）以及非常规WMI查询事件。防御建议包括启用详细进程审计、限制低权限用户的服务查询操作，以及部署用户行为分析（UEBA）系统识别异常服务访问模式。

面对日益完善的安全监测体系，攻击者发展出深度隐藏的服务发现技术，通过寄生合法进程、分散元数据采集、污染审计日志等手法，将服务枚举行为融入系统正常运维活动中，显著降低了传统基于规则匹配和行为阈值的检测机制有效性。

当前系统服务发现匿迹技术的演进呈现共性特征：首先，攻击过程与系统合法组件的深度融合，通过API调用劫持、内存驻留执行等技术实现"无实体化"攻击；其次，时空维度上的行为特征稀释，采用低频次、碎片化的元数据采集策略突破连续行为分析模型的检测边界。具体而言，合法工具隐蔽调用技术利用系统白名单机制实现攻击行为的表面合法化；碎片化采集策略突破基于完整服务清单比对的检测模型，使得服务发现行为在进程层、行为层和审计层均实现深度隐匿。

匿迹技术的发展迫使防御体系向纵深防御方向演进，需构建内存行为监控、跨周期行为关联分析、日志完整性保护等新型防御能力，同时结合服务访问最小特权原则和拟态化服务控制接口，实现对隐蔽服务发现行为的立体化防护。

ID: T1007
Sub-techniques:  T1007.001, T1007.002
ⓘ
Tactic: 环境测绘
ⓘ
Platforms: Linux, Windows, macOS
Contributors: Harshal Tupsamudre, Qualys
Version: 1.5
Created: 31 May 2017
Last Modified: 03 April 2023

匿迹效应

效应类型 是否存在
特征伪装 ❌
行为透明 ✅
数据遮蔽 ❌
时空释痕 ✅

行为透明

攻击者通过使用常见的命令查询系统服务信息，这些命令通常用于系统管理员日常的维护工作，系统中的合法命令本身难以与恶意行为区分开来，使得攻击者能够悄无声息地进行信息收集。服务查询命令的参数组合、执行时序均与合法运维行为相似，使得传统基于进程行为监控的检测机制无法感知攻击行为，实现服务发现操作的“执行过程透明化”。

时空释痕

服务元数据碎片化采集技术将完整的服务发现任务分解为数百个离散的元数据查询操作，单个操作间隔数小时且仅获取有限服务属性。这种低频长周期的攻击节奏使得服务发现特征被稀释在数周甚至数月的系统活动周期中，传统基于短时间窗口的行为分析模型难以有效检测。

Procedure Examples

ID Name Description
G0018 admin@338

admin@338 actors used the following command following exploitation of a machine with LOWBALL malware to obtain information about services: net start >> %temp%\download[1]
G0006 APT1

APT1 used the commands net start and tasklist to get a listing of the services on the system.[2]
G0143 Aquatic Panda

Aquatic Panda has attempted to discover services for third party EDR products.[3]
S0638 Babuk

Babuk can enumerate all services running on a compromised host.[4]
S0127 BBSRAT

BBSRAT can query service configuration information.[5]
S0570 BitPaymer

BitPaymer can enumerate existing Windows services on the host that are configured to run as LocalSystem.[6]
S1070 Black Basta

Black Basta can check whether the service name FAX is present.[7]
G0060 BRONZE BUTLER

BRONZE BUTLER has used TROJ_GETVERSION to discover system services.[8]
S0572 Caterpillar WebShell

Caterpillar WebShell can obtain a list of the services from a system.[9]

G0114 Chimera

Chimera has used net start and net use for system service discovery.[10]
S0154 Cobalt Strike

Cobalt Strike can enumerate services on compromised hosts.[11]
S0244 Comnie

Comnie runs the command: net start >> %TEMP%\info.dat on a victim.[12]
S0625 Cuba

Cuba can query service status using QueryServiceStatusEx function.[13]
S1066 DarkTortilla

DarkTortilla can retrieve information about a compromised system's running services.[14]
S0024 Dyre

Dyre has the ability to identify running services on a compromised host.[15]
G1006 Earth Lusca

Earth Lusca has used Tasklist to obtain information from a compromised host.[16]
S0081 Elise

Elise executes net start after initial communication is made to the remote server.[17]
S0082 Emissary

Emissary has the capability to execute the command net start to interact with services.[18]
S0091 Epic

Epic uses the tasklist /svc command to list the services on the system.[19]
S0049 GeminiDuke

GeminiDuke collects information on programs and services on the victim that are configured to automatically run at startup.[20]
S0237 GravityRAT

GravityRAT has a feature to list the available services on the system.[21]
S0342 GreyEnergy

GreyEnergy enumerates all Windows services.[22]
S1027 Heyoka Backdoor

Heyoka Backdoor can check if it is running as a service on a compromised host.[23]
S0431 HotCroissant

HotCroissant has the ability to retrieve a list of services on the infected host.[24]
S0203 Hydraq

Hydraq creates a backdoor through which remote attackers can monitor services.[25][26]
S0398 HyperBro

HyperBro can list all services and their configurations.[27]
G0119 Indrik Spider

Indrik Spider has used the win32_service WMI class to retrieve a list of services from the system.[28]

S0260 InvisiMole

InvisiMole can obtain running services on the victim.[29]
S0015 Ixeshe

Ixeshe can list running services.[30]
S0201 JPIN

JPIN can list running services.[31]
S0283 jRAT

jRAT can list local services.[32]
G0004 Ke3chang

Ke3chang performs service discovery using net start commands.[33]
G0094 Kimsuky

Kimsuky has used an instrumentor script to gather the names of all services running on a victim's system.[34]
S0236 Kwampirs

Kwampirs collects a list of running services with the command tasklist /svc.[35]
S0582 LookBack

LookBack can enumerate services on the victim machine.[36]
S0039 Net

The net start command can be used in Net to find information about Windows services.[37]
G0049 OilRig

OilRig has used sc query on a victim to gather information about services.[38]
C0012 Operation CuckooBees

During Operation CuckooBees, the threat actors used the net start command as part of their initial reconnaissance.[39]
C0014 Operation Wocao

During Operation Wocao, threat actors used the tasklist command to search for one of its backdoors.[40]
G0033 Poseidon Group

After compromising a victim, Poseidon Group discovers all running services.[41]
S0378 PoshC2

PoshC2 can enumerate service and service permission information.[42]
S0629 RainyDay

RainyDay can create and register a service for execution.[43]
S0241 RATANKBA

RATANKBA uses tasklist /svc to display running tasks.[44]
S0496 REvil

REvil can enumerate active services.[45]
S0085 S-Type

S-Type runs the command net start on a victim.[46]
S1085 Sardonic

Sardonic has the ability to execute the net start command.[47]
S0692 SILENTTRINITY

SILENTTRINITY can search for modifiable services that could be used for privilege escalation.[48]
S0533 SLOTHFULMEDIA

SLOTHFULMEDIA has the capability to enumerate services.[49]
S0615 SombRAT

SombRAT can enumerate services on a victim machine.[50]
S0559 SUNBURST

SUNBURST collected a list of service names that were hashed using a FNV-1a + XOR algorithm to check against similarly-hashed hardcoded blocklists.[51]
S0018 Sykipot

Sykipot may use net start to display running services.[52]
S0242 SynAck

SynAck enumerates all running services.[53][54]
S0663 SysUpdate

SysUpdate can collect a list of services on a victim machine.[55]
S0057 Tasklist

Tasklist can be used to discover services running on a system.[56]
G0139 TeamTNT

TeamTNT has searched for services such as Alibaba Cloud Security's aliyun service and BMC Helix Cloud Security's bmc-agent service in order to disable them.[57]
S0266 TrickBot

TrickBot collects a list of install programs and services on the system’s machine.[58]
G0010 Turla

Turla surveys a system upon check-in to discover running services and associated processes using the tasklist /svc command.[19]
S0386 Ursnif

Ursnif has gathered information about running services.[59]
S0180 Volgmer

Volgmer queries the system to identify existing services.[60]
G1017 Volt Typhoon

Volt Typhoon has used net start to list running services.[61]
S0219 WINERACK

WINERACK can enumerate services.[62]
S0086 ZLib

ZLib has the ability to discover and manipulate Windows services.[46]
S0412 ZxShell

ZxShell can check the services on the system.[63]

Mitigations

This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features.

Detection

ID Data Source Data Component Detects
DS0017 Command Command Execution

Monitor executed commands and arguments that could be taken to gather system information related to services. Remote access tools with built-in features may interact directly with the Windows API to gather information. Information may also be acquired through Windows system management tools such as Windows Management Instrumentation and PowerShell.
DS0009 Process OS API Execution

Monitor for API calls associated with gathering information about registered local system services, such as QueryServiceStatusEx. Other Windows API calls worth monitoring include EnumServicesStatusExA, which can be used to enumerate services in the service control manager database.

Note: Most EDR tools do not support direct monitoring of API calls due to the sheer volume of calls produced by an endpoint but may have alerts or events that are based on abstractions of OS API calls. Dynamic malware analysis tools (i.e., sandboxes) can be used to trace the execution, including OS API calls, for a single PE binary.
Process Creation

Monitor for newly executed processes with arguments that may try to get information about registered services. System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as Lateral Movement, based on the information obtained.

Note: Event IDs are for Sysmon (Event ID 1 - process create) and Windows Security Log (Event ID 4688 - a new process has been created). For event id 4688, depending on Windows version, you might need to enable Administrative Templates\System\Audit Process Creation\Include command line in process creation events group policy to include command line in process creation events.

Analytic 1 - Suspicious Processes

((sourcetype="WinEventLog:Security" EventCode="4688") OR (sourcetype="WinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode="1") | WHERE ((CommandLine LIKE "%sc%" AND CommandLine LIKE "%query%") OR (CommandLine LIKE "%tasklist%" AND CommandLine LIKE "%/svc%") OR (CommandLine LIKE "%systemctl%" AND CommandLine LIKE "%--type=service%") OR (CommandLine LIKE "%net%" AND CommandLine LIKE "%start%"))

References

  1. FireEye Threat Intelligence. (2015, December 1). China-based Cyber Threat Group Uses Dropbox for Malware Communications and Targets Hong Kong Media Outlets. Retrieved December 4, 2015.
  2. Mandiant. (n.d.). APT1 Exposing One of China’s Cyber Espionage Units. Retrieved July 18, 2016.
  3. Wiley, B. et al. (2021, December 29). OverWatch Exposes AQUATIC PANDA in Possession of Log4Shell Exploit Tools During Hands-on Intrusion Attempt. Retrieved January 18, 2022.
  4. Mundo, A. et al. (2021, February). Technical Analysis of Babuk Ransomware. Retrieved August 11, 2021.
  5. Lee, B. Grunzweig, J. (2015, December 22). BBSRAT Attacks Targeting Russian Organizations Linked to Roaming Tiger. Retrieved August 19, 2016.
  6. Frankoff, S., Hartley, B. (2018, November 14). Big Game Hunting: The Evolution of INDRIK SPIDER From Dridex Wire Fraud to BitPaymer Targeted Ransomware. Retrieved January 6, 2021.
  7. Cyble. (2022, May 6). New ransomware variant targeting high-value organizations. Retrieved March 7, 2023.
  8. Chen, J. et al. (2019, November). Operation ENDTRADE: TICK’s Multi-Stage Backdoors for Attacking Industries and Stealing Classified Data. Retrieved June 9, 2020.
  9. ClearSky Cyber Security. (2021, January). “Lebanese Cedar” APT Global Lebanese Espionage Campaign Leveraging Web Servers. Retrieved February 10, 2021.
  10. Jansen, W . (2021, January 12). Abusing cloud services to fly under the radar. Retrieved September 12, 2024.
  11. Strategic Cyber LLC. (2020, November 5). Cobalt Strike: Advanced Threat Tactics for Penetration Testers. Retrieved April 13, 2021.
  12. Grunzweig, J. (2018, January 31). Comnie Continues to Target Organizations in East Asia. Retrieved June 7, 2018.
  13. Roccio, T., et al. (2021, April). Technical Analysis of Cuba Ransomware. Retrieved June 18, 2021.
  14. Secureworks Counter Threat Unit Research Team. (2022, August 17). DarkTortilla Malware Analysis. Retrieved November 3, 2022.
  15. hasherezade. (2015, November 4). A Technical Look At Dyreza. Retrieved June 15, 2020.
  16. Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022.
  17. Falcone, R., et al.. (2015, June 16). Operation Lotus Blossom. Retrieved February 15, 2016.
  18. Falcone, R. and Miller-Osborn, J. (2016, February 3). Emissary Trojan Changelog: Did Operation Lotus Blossom Cause It to Evolve?. Retrieved February 15, 2016.
  19. Kaspersky Lab's Global Research and Analysis Team. (2014, August 7). The Epic Turla Operation: Solving some of the mysteries of Snake/Uroburos. Retrieved December 11, 2014.
  20. F-Secure Labs. (2015, September 17). The Dukes: 7 years of Russian cyberespionage. Retrieved December 10, 2015.
  21. Mercer, W., Rascagneres, P. (2018, April 26). GravityRAT - The Two-Year Evolution Of An APT Targeting India. Retrieved May 16, 2018.
  22. Cherepanov, A. (2018, October). GREYENERGY A successor to BlackEnergy. Retrieved November 15, 2018.
  23. Chen, Joey. (2022, June 9). Aoqin Dragon | Newly-Discovered Chinese-linked APT Has Been Quietly Spying On Organizations For 10 Years. Retrieved July 14, 2022.
  24. Knight, S.. (2020, April 16). VMware Carbon Black TAU Threat Analysis: The Evolution of Lazarus. Retrieved May 1, 2020.
  25. Symantec Security Response. (2010, January 18). The Trojan.Hydraq Incident. Retrieved February 20, 2018.
  26. Lelli, A. (2010, January 11). Trojan.Hydraq. Retrieved February 20, 2018.
  27. Falcone, R. and Lancaster, T. (2019, May 28). Emissary Panda Attacks Middle East Government Sharepoint Servers. Retrieved July 9, 2019.
  28. Symantec Threat Intelligence. (2020, June 25). WastedLocker: Symantec Identifies Wave of Attacks Against U.S. Organizations. Retrieved May 20, 2021.
  29. Hromcová, Z. (2018, June 07). InvisiMole: Surprisingly equipped spyware, undercover since 2013. Retrieved July 10, 2018.
  30. Sancho, D., et al. (2012, May 22). IXESHE An APT Campaign. Retrieved June 7, 2019.
  31. Windows Defender Advanced Threat Hunting Team. (2016, April 29). PLATINUM: Targeted attacks in South and Southeast Asia. Retrieved February 15, 2018.
  32. Kamluk, V. & Gostev, A. (2016, February). Adwind - A Cross-Platform RAT. Retrieved April 23, 2019.
  1. Villeneuve, N., Bennett, J. T., Moran, N., Haq, T., Scott, M., & Geers, K. (2014). OPERATION “KE3CHANG”: Targeted Attacks Against Ministries of Foreign Affairs. Retrieved November 12, 2014.
  2. An, J and Malhotra, A. (2021, November 10). North Korean attackers use malicious blogs to deliver malware to high-profile South Korean targets. Retrieved December 29, 2021.
  3. Symantec Security Response Attack Investigation Team. (2018, April 23). New Orangeworm attack group targets the healthcare sector in the U.S., Europe, and Asia. Retrieved May 8, 2018.
  4. Raggi, M. Schwarz, D.. (2019, August 1). LookBack Malware Targets the United States Utilities Sector with Phishing Attacks Impersonating Engineering Licensing Boards. Retrieved February 25, 2021.
  5. Savill, J. (1999, March 4). Net.exe reference. Retrieved September 22, 2015.
  6. Falcone, R. and Lee, B.. (2016, May 26). The OilRig Campaign: Attacks on Saudi Arabian Organizations Deliver Helminth Backdoor. Retrieved May 3, 2017.
  7. Cybereason Nocturnus. (2022, May 4). Operation CuckooBees: Deep-Dive into Stealthy Winnti Techniques. Retrieved September 22, 2022.
  8. Dantzig, M. v., Schamper, E. (2019, December 19). Operation Wocao: Shining a light on one of China’s hidden hacking groups. Retrieved October 8, 2020.
  9. Kaspersky Lab's Global Research and Analysis Team. (2016, February 9). Poseidon Group: a Targeted Attack Boutique specializing in global cyber-espionage. Retrieved March 16, 2016.
  10. Nettitude. (2018, July 23). Python Server for PoshC2. Retrieved April 23, 2019.
  11. Vrabie, V. (2021, April 23). NAIKON – Traces from a Military Cyber-Espionage Operation. Retrieved June 29, 2021.
  12. Trend Micro. (2017, February 27). RATANKBA: Delving into Large-scale Watering Holes against Enterprises. Retrieved May 22, 2018.
  13. Intel 471 Malware Intelligence team. (2020, March 31). REvil Ransomware-as-a-Service – An analysis of a ransomware affiliate operation. Retrieved August 4, 2020.
  14. Gross, J. (2016, February 23). Operation Dust Storm. Retrieved December 22, 2021.
  15. Budaca, E., et al. (2021, August 25). FIN8 Threat Actor Goes Agile with New Sardonic Backdoor. Retrieved August 9, 2023.
  16. Salvati, M. (2019, August 6). SILENTTRINITY Modules. Retrieved March 24, 2022.
  17. DHS/CISA, Cyber National Mission Force. (2020, October 1). Malware Analysis Report (MAR) MAR-10303705-1.v1 – Remote Access Trojan: SLOTHFULMEDIA. Retrieved October 2, 2020.
  18. The BlackBerry Research and Intelligence Team. (2020, November 12). The CostaRicto Campaign: Cyber-Espionage Outsourced. Retrieved May 24, 2021.
  19. FireEye. (2020, December 13). Highly Evasive Attacker Leverages SolarWinds Supply Chain to Compromise Multiple Global Victims With SUNBURST Backdoor. Retrieved January 4, 2021.
  20. Blasco, J. (2011, December 12). Another Sykipot sample likely targeting US federal agencies. Retrieved March 28, 2016.
  21. Ivanov, A. et al. (2018, May 7). SynAck targeted ransomware uses the Doppelgänging technique. Retrieved May 22, 2018.
  22. Bettencourt, J. (2018, May 7). Kaspersky Lab finds new variant of SynAck ransomware using sophisticated Doppelgänging technique. Retrieved May 24, 2018.
  23. Daniel Lunghi. (2023, March 1). Iron Tiger’s SysUpdate Reappears, Adds Linux Targeting. Retrieved March 20, 2023.
  24. Microsoft. (n.d.). Tasklist. Retrieved December 23, 2015.
  25. Darin Smith. (2022, April 21). TeamTNT targeting AWS, Alibaba. Retrieved August 4, 2022.
  26. Salinas, M., Holguin, J. (2017, June). Evolution of Trickbot. Retrieved July 31, 2018.
  27. Caragay, R. (2015, March 26). URSNIF: The Multifaceted Malware. Retrieved June 5, 2019.
  28. US-CERT. (2017, November 22). Alert (TA17-318B): HIDDEN COBRA – North Korean Trojan: Volgmer. Retrieved December 7, 2017.
  29. CISA et al.. (2024, February 7). PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure. Retrieved May 15, 2024.
  30. FireEye. (2018, February 20). APT37 (Reaper): The Overlooked North Korean Actor. Retrieved March 1, 2018.
  31. Allievi, A., et al. (2014, October 28). Threat Spotlight: Group 72, Opening the ZxShell. Retrieved September 24, 2019.