System Service Discovery

This Windows implementation of MITRE ATT&CK T1007 enumerates locally registered services and, depending on the selected command, their current state and startup configuration. Service inventory can inform follow-on investigation of service-based persistence or privilege-escalation opportunities; this read-only procedure does not modify services. T1007 also covers native service discovery on Linux and macOS, which these Windows commands do not implement.