T1007 System Service Discovery: Detecting Service Enumeration Before Credential Theft

Service enumeration is how an intruder learns which processes on a host run as privileged or domain service accounts, which security agents are present and which services to stop before encryption. MITRE ATT&CK tracks this as T1007 System Service Discovery, a Discovery technique on Windows, Linux and macOS. On its own it changes nothing on the host, so it cannot be blocked outright, but it reliably appears in the first minutes of hands-on activity and it points straight at the next step: reading service account secrets from the LSA store or stopping security tools. This guide is for detection engineers, SOC analysts and identity teams who need detections that separate hostile enumeration from the constant service queries made by management tools. It covers the v20 detection strategy, the telemetry that matters, real procedure examples, and how to reduce what an attacker gains from the answer.

Key takeaways

• Prevention is not the goal. ATT&CK v20 lists no mitigation for T1007, and Windows grants every locally authenticated user the right to enumerate services and read their configuration, including the logon account.
• Sequence beats single events. One net start is noise; service listing followed within minutes by account discovery, security tool checks or access to LSA secrets is a strong signal.
• The answer is what hurts you. A service running as a domain account stores its password as an LSA secret on every host where it runs, so enumeration tells an attacker where to harvest credentials.
• Ransomware uses it to pick targets. BitPaymer, Medusa and Qilin procedure examples in ATT&CK show service lists used to choose services to stop or leave running.
• Reduce the payoff. Moving services to virtual accounts or group managed service accounts and removing domain admin rights from service accounts makes successful discovery far less valuable.

What T1007 covers in ATT&CK v20

ATT&CK v20 (technique version 1.6) describes System Service Discovery as gathering information about registered local system services, using tools or operating system utilities such as sc query, tasklist /svc, systemctl --type=service and net start. The v20 description also includes listing scheduled tasks with schtasks on Windows or crontab -l on Linux and macOS, and notes that adversaries use the result during automated discovery to decide whether to fully infect a host or take specific actions. There are no sub-techniques and no listed mitigations.

It sits beside several related techniques that each have their own page: Process Discovery (T1057), Security Software Discovery (T1518.001), System Information Discovery (T1082), and on the follow-on side Windows Service (T1543.003), Service Execution (T1569.002), Service Stop (T1489) and LSA Secrets (T1003.004).

Why defenders cannot simply lock it down

Microsoft's service security documentation sets the default rights. Local authenticated users, including LocalService and NetworkService, receive SC_MANAGER_CONNECT and SC_MANAGER_ENUMERATE_SERVICE on the Service Control Manager, and SERVICE_QUERY_CONFIG and SERVICE_QUERY_STATUS on each service. Remote authenticated users receive only SC_MANAGER_CONNECT and, since Windows Server 2003 SP1, see no services when they enumerate remotely. In practice this means:

• Local code sees everything: any process running as a logged-on user can list services and read each service's configuration, including the account it runs as.
• Remote enumeration needs administrator rights: a remote service listing against a member server usually means the caller holds local admin, which is itself worth alerting on when the source is not a management server.
• Hardening service ACLs is rarely worth it: changing default service descriptors breaks management and monitoring agents; spend the effort on detection and on the accounts the services use.

How adversaries use service discovery

The ATT&CK v20 data holds about 70 procedure examples for T1007. They fall into four purposes, and each purpose shapes what to detect next.

The fourth row matters for detection design. When enumeration happens through WMI or the service control API from inside an implant, there is no sc.exe or net.exe process to catch, so command line rules alone miss it. See the T1047 Windows Management Instrumentation Defensive Guide for WMI telemetry.

The service account angle

ATT&CK's LSA Secrets technique (T1003.004) states that LSA secrets can contain credentials for service accounts and are stored in the registry under HKEY_LOCAL_MACHINE\SECURITY\Policy\Secrets, readable with SYSTEM access. Service discovery is the cheap first step that tells an intruder whether that effort will pay: a service whose logon account is a domain user (rather than LocalSystem, a virtual account or a gMSA) means a reusable domain password sits on that host. A domain account that runs services on many servers turns one compromised server into a path to all of them. The How to find Windows services running as domain accounts guide covers building that inventory; this page covers catching an attacker doing the same thing. See also the T1003 OS Credential Dumping guide.

What to detect and where

ATT&CK v20 detection strategy DET0483, "Detection of System Service Discovery Commands Across OS Platforms", defines one analytic per platform. The table lists the data components and log sources it names, with the practical notes we add.

Windows telemetry settings

• Command lines in 4688: enable Audit Process Creation (Advanced Audit Policy, Detailed Tracking) and the Administrative Templates setting "Include command line in process creation events". Microsoft warns that command lines are logged in plain text and may contain passwords, so restrict who can read the Security log. Also enable "Audit: Force audit policy subcategory settings to override audit policy category settings" so basic policy cannot overwrite it.
• Sysmon event 1: process creation with full command line, parent image and ProcessGUID for correlation. See the Sysmon Guide.
• PowerShell script block logging (4104): catches Get-Service, Get-CimInstance Win32_Service and WMI queries that never spawn a child process.
• Event 4697 (Audit Security System Extension): not a discovery signal, but the natural follow-on. Microsoft's monitoring guidance flags service accounts other than localSystem, localService or networkService, file paths outside %windir% and Program Files, and driver service types 0x1, 0x2 and 0x8.

Detection logic that holds up

Baselining the noise

Service queries are constant in a managed estate: SCCM and Intune agents, RMM tools, monitoring agents, backup software and vulnerability scanners all list services. Build the allow list on the parent process and signer, not the command line, and scope it to the hosts the tool is meant to manage. CISA's Volt Typhoon advisory makes the same point in general terms: establish and maintain a baseline of installed tools and software, account behaviour and network traffic, because living off the land activity only stands out against that baseline. See the Living off the Land Guide.

Mitigations and exposure reduction

ATT&CK v20 maps no mitigation to T1007, because the behaviour uses system features that cannot be removed. The controls below are NHI Mgmt Group recommendations that reduce what the attacker learns and what the answer is worth.

1. Replace domain user service accounts. Run services as virtual accounts or the built-in service identities where they only need local access, and as group managed service accounts (gMSAs) where they need network identity. Microsoft documents that gMSA passwords are computed by domain controllers from Key Distribution Service key material and retrieved by permitted hosts, so no person sets or knows them. See the Group Managed Service Accounts (gMSA) Guide.
2. Strip privilege from what remains. No service account should hold Domain Admin or equivalent. See How to find service accounts with Domain Admin rights.
3. Stop one account running on many hosts. A shared service account multiplies the value of each LSA secret; split by tier and function.
4. Protect the credential store. Credential Guard protects derived domain credentials in LSASS memory, though it does not cover every secret type. See Credential Guard and VBS.
5. Restrict remote admin. Unique local administrator passwords with Windows LAPS limit the hosts an intruder can enumerate remotely.
6. Protect security agents. Turn on tamper protection in the EDR so that finding the service does not lead to stopping it. See the EDR Tampering and BYOVD Response Playbook.

Where identity fits

Every service logon account is a non-human identity, usually with no owner, a password that has not changed in years and rights nobody has reviewed. T1007 detections are most useful when they feed that governance: when an alert fires on a host, the triage question is not only "who ran the query" but "which service accounts on this host should we now treat as exposed". Keep a service account inventory that records host spread and privilege so the answer takes minutes. See the Service Account Security Guide and How to detect interactive logons by service accounts, which catches the next stage when a harvested password is reused.

How to test your coverage

1. Confirm telemetry first. On a pilot host, check that 4688 events carry command lines, that Sysmon event 1 and PowerShell 4104 arrive in the SIEM, and that Linux auditd EXECVE records are collected.
2. Emulate in an authorised test. Use a purple team plan or an open emulation library to run service listing through each route: native command, PowerShell cmdlet, WMI class and remote query. Record which routes produce an alert.
3. Emulate the sequence. Run service, process, account and network discovery from an unusual parent in one session and confirm the correlation rule fires once, with all steps attached.
4. Measure noise for two weeks in alert-only mode before routing to the SOC queue, then tune by parent and signer.
5. Roll back safely. Keep new rules in a separate rule group so they can be disabled without touching existing detections.

Metrics

• Telemetry coverage: percentage of Windows servers sending 4688 with command lines or Sysmon event 1 (target 100% of tier 0 and tier 1).
• Route coverage: number of the four enumeration routes that raise a detection in testing.
• Noise: T1007 alerts per 1,000 hosts per week after tuning, and the share closed as benign.
• Exposure: count of services running as domain user accounts, and of those accounts present on more than five hosts, trending down.
• Response: median time from a discovery sequence alert to a decision on the host's service account credentials.

Common failure patterns

• Command line only. Rules match sc.exe and net.exe but not WMI or API enumeration, which is how Cobalt Strike and Indrik Spider style tooling works.
• Command line logging off on servers. 4688 without the command line setting records that net.exe ran, not what it did.
• Alerting on every query. A rule that fires on each service listing gets disabled within a week; anchor on parent process and sequence.
• Treating the host as the only victim. When discovery is found, teams reimage the server but leave the domain service account password unchanged, though it was readable on that host.
• Allow listing by tool name. Exempting "anything that runs from the RMM agent" hands attackers who abuse that RMM a free pass; scope allow lists to signer, path and host group.

Framework mapping

Practitioner checklist

• Enable Audit Process Creation with command line inclusion, or Sysmon event 1, on every Windows server, and restrict Security log read access.
• Enable PowerShell script block logging and collect WMI activity so API and cmdlet enumeration is visible.
• Collect auditd EXECVE on Linux servers and container hosts, and process events on macOS.
• Build a sequence rule for multiple discovery techniques from one unusual parent within a short window.
• Alert on service queries for security products followed by stop or configuration changes.
• Baseline management tools by signer, path and host group, not by command name.
• Inventory services that run as domain user accounts and move them to virtual accounts or gMSAs.
• Add "rotate service account passwords present on this host" to the response playbook for discovery alerts.
• Test all four enumeration routes each quarter and record route coverage.

Standards and references

• MITRE ATT&CK: T1007 System Service Discovery
• MITRE ATT&CK: T1003.004 LSA Secrets
• CISA: AA24-038A PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure
• Microsoft Learn: Service Security and Access Rights
• Microsoft Learn: Command line process auditing
• Microsoft Learn: 4697(S) A service was installed in the system
• Microsoft Learn: Group Managed Service Accounts overview
• Microsoft Learn: Sysmon

Related NHI Mgmt Group resources: Windows Services and Service Account Security Guide · T1087 and T1069 Account and Permission Group Discovery Defensive Guide · ATT&CK Credential Access Tactic Guide · ATT&CK Detection Strategies and Analytics Guide