CmdID

CmdID / Techniques

T1007 System Service Discovery

Adversaries may try to gather information about registered local system services. MITRE ATT&CK

3 programs on CmdID 10 Sigma rules T1007 on attack.mitre.org

Programs for it

documented by LOLBAS and GTFOBins, or named by its rules
crontabits Sigma rulesreg.exeits Sigma rulessc.exeits Sigma rules

Sigma rules tagged with it

process creation, the highest levels first
highHackTool - PCHunter ExecutionFlorian Roth (Nextron Systems), Nasreddine Bencherchali · Windows
mediumESXi Network Configuration Discovery Via ESXCLICedric Maurugeon · Linux
mediumESXi Storage Information Discovery Via ESXCLINasreddine Bencherchali (Nextron Systems), Cedric Maurugeon · Linux
mediumESXi System Information Discovery Via ESXCLICedric Maurugeon · Linux
mediumESXi VM List Discovery Via ESXCLICedric Maurugeon · Linux
mediumESXi VSAN Information Discovery Via ESXCLINasreddine Bencherchali (Nextron Systems), Cedric Maurugeon · Linux
mediumPotential Configuration And Service Reconnaissance Via Reg.EXETimur Zinniatullin, oscd.community · Windows
lowCrontab EnumerationJoseliyo Sanchez, @Joseliyo_Jstnk · Linux
lowNet.EXE ExecutionMichael Haag, Mark Woan (improvements), James Pemberton / @4A616D6573 / oscd.community (improvements) · Windows
lowSC.EXE Query Executionfrack113 · Windows

Command lines CmdID reads as it

everyday examples from tldr-pages, CC BY 4.0

Show the status of a service (no service name will list all services) on the page for sc.exe

sc query service_nameIdentify

Start or stop a Windows service synchronously on the page for net

net start serviceIdentify

Show the folders currently shared over SMB on the page for net

net shareIdentify

Show users in a local security group on the page for net

net localgroup "Administrators"Identify

To display a list of all user accounts for the local computer, run the following command on the page for net user

net userIdentify

To display information about the user account TommyH, run the following command on the page for net user

net user tommyhIdentify

To set the sign-in time from 8 AM to 5 PM for the username MikeD using 24-hour notation, run the following command on the page for net user

net user miked /time:M-F,08:00-17:00Identify

To set the sign-in time from 8 AM to 5 PM for MikeD using 12-hour notation, run the following command on the page for net user

net user miked /time:M-F,8AM-5PMIdentify

To specify sign-in hours of 4 AM to 12 PM on Monday, 12 PM to 8 PM on Tuesday, and 8 AM to 5 PM Wednesday through Friday for username AnibalS, run the following command on the page for net user

net user anibals /time:M,4AM-12PM;T,12PM-8PM;W-F,8AM-5PMIdentify

To display information for active services only, type either of the following commands on the page for sc query

sc.exe query sc.exe query type= serviceIdentify

To display information for active services, and to specify a buffer size of 2,000 bytes, type on the page for sc query

sc.exe query type= all bufsize= 2000Identify

To display information for the wuauserv service, type on the page for sc query

sc.exe query wuauservIdentify

And 5 more examples on CmdID’s program pages.

An example is here when CmdID’s reading of it names T1007: a Sigma rule it trips is tagged with it, or its abuse is documented as it.