AN1325
Analytic 1325
Windows
Enumeration of services via native CLI tools (e.g., `sc query`, `tasklist /svc`, `net start`) or API calls via PowerShell and WMI.
WinEventLog:Security
EventCode=4688
WinEventLog:PowerShell
EventCode=4103, 4104, 4105, 4106
[ProcessName]
Can be tuned to specific binaries used for service enumeration (e.g., `sc.exe`, `tasklist.exe`).
[CommandLineMatch]
Filters for variations like `sc query`, `net start`, `Get-Service`.
[ParentProcess]
Used to suppress known admin scripts or automation jobs.
AN1326
Analytic 1326
Linux
Execution of service management commands like `systemctl list-units`, `service --status-all`, or direct reading of `/etc/init.d`.
auditd:EXECVE
execve
[CommandPattern]
Includes service enumeration commands like `systemctl`, `service`, or custom scripts.
[ExecutionUser]
Tunable by user context (e.g., root vs. standard user).
[TimeWindow]
Used for correlation with privilege escalation or lateral movement.
AN1327
Analytic 1327
macOS
Discovery via launchctl commands, or process enumeration using `ps aux | grep com.apple.` to identify daemons and services.
macos:unifiedlog
None
macos:osquery
process_events
[CommandLineContent]
Tune to recognize `launchctl list`, `launchctl print`, or service grep strings.
[ProcessParent]
Filter known benign automation or MDM agent invocations.