Adversaries may try to gather information about registered local system services. Adversaries may obtain information about services using tools as well as OS utility commands such as <code>sc query</code>, <code>tasklist /svc</code>, <code>systemctl –type=service</code>, and <code>net start</code>.
Adversaries may use the information from System Service Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
View in MITRE ATT&CK®| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| intel-tdt | Intel Threat Detection Technology | CrowdStrike AMS | T1007 | System Service Discovery |
Comments
Intel Threat Detection Technology (TDT), in conjunction with CrowdStrike Falcon Accelerated Memory Scanning (CAMS), enhances cybersecurity defenses by enabling faster, real-time detection of System Service Discovery attacks. This integrated solution strengthens CrowdStrike Falcon, improving its ability to detect and mitigate cyber threats earlier in the kill chain, while minimizing system performance impact.
System Service Discovery techniques involve attackers identifying and enumerating services running on a compromised system. By discovering active services, adversaries can assess which system functionalities are available, determine attack vectors for further exploitation, or locate valuable services to target for lateral movement or privilege escalation. These techniques often focus on services like Windows Management Instrumentation (WMI), Remote Desktop Protocol (RDP), or other critical infrastructure services that could be leveraged for malicious actions.
Intel TDT plays a critical role in identifying these threats by providing real-time telemetry on program execution, memory access, and control flow at the hardware level. This telemetry helps security teams detect abnormal behaviors, such as unauthorized queries or interactions with system services, that could indicate reconnaissance activities aimed at identifying or exploiting system services. By continuously monitoring these low-level activities, Intel TDT enables rapid detection and mitigation of attempts to discover and target system services for malicious purposes.
References
|