Sigma Rule Library

MITRE ATT&CK technique

System Service Discovery detection rulesT1007

System Service Discovery (T1007) is a MITRE ATT&CK technique in the Discovery tactic. This page lists the 11 community-maintained Sigma detection rules in the library mapped to T1007 and its sub-techniques. Each rule includes its detection logic, log source, false positives and original YAML. These rules mainly target linux, windows.

T1007 on attack.mitre.org11 rules

Top products

Tactic

Discovery

HackTool - PCHunter Execution
high
Detects suspicious use of PCHunter, a tool like Process Hacker to view and manipulate processes, kernel options and other low level stuff
windows · process_creation
ESXi Network Configuration Discovery Via ESXCLI
medium
Detects execution of the "esxcli" command with the "network" flag in order to retrieve information about the network configuration.
linux · process_creation
ESXi Storage Information Discovery Via ESXCLI
medium
Detects execution of the "esxcli" command with the "storage" flag in order to retrieve information about the storage status and other related information. Seen used by malware such as DarkSide and LockBit.
linux · process_creation
ESXi System Information Discovery Via ESXCLI
medium
Detects execution of the "esxcli" command with the "system" flag in order to retrieve information about the different component of the system. Such as accounts, modules, NTP, etc.
linux · process_creation
ESXi VM List Discovery Via ESXCLI
medium
Detects execution of the "esxcli" command with the "vm" flag in order to retrieve information about the installed VMs.
linux · process_creation
ESXi VSAN Information Discovery Via ESXCLI
medium
Detects execution of the "esxcli" command with the "vsan" flag in order to retrieve information about virtual storage. Seen used by malware such as DarkSide.
linux · process_creation
Potential Configuration And Service Reconnaissance Via Reg.EXE
medium
Detects the usage of "reg.exe" in order to query reconnaissance information from the registry. Adversaries may interact with the Windows registry to gather information about credentials, the system, configuration, and installed software.
windows · process_creation
Potential Registry Reconnaissance Via PowerShell Script
medium
Detects PowerShell scripts with potential registry reconnaissance capabilities. Adversaries may interact with the Windows registry to gather information about the system credentials, configuration, and installed software.
windows · ps_script
Crontab Enumeration
low
Detects usage of crontab to list the tasks of the user
linux · process_creation
Net.EXE Execution
low
Detects execution of "Net.EXE".
windows · process_creation
SC.EXE Query Execution
low
Detects execution of "sc.exe" to query information about registered services on the system
windows · process_creation