TACTIC: DISCOVERY
System Service Discovery (T1007): Real Cases
MITRE Definition ↗ Adversaries list configured system services to find exploitable software paths and vulnerable configurations.
Key Facts
Technique ID
T1007
Discovery
Mapped Cases
1
Primary sources
Related Laws
3
Criminal statutes
- ATT&CK Technique Identifier: T1007.
- Tactical Phase: Discovery.
- Substantiated in 1 primary court prosecution and advisory cases.
- Linked records cite judicial dockets, plea agreements, or federal advisories.
Verified Evidentiary Case Records (1)
U.S. v. Vachon-Desjardins (Netwalker Ransomware)
sentenced 2020-12-16
Affiliate of Netwalker ransomware responsible for attacking dozens of healthcare systems, universities, and businesses during the COVID-19 pandemic, extorting tens of millions of dollars.
Primary Source Evidence Excerpt: Plea Agreement ¶ 5, Page 13
"Vachon-Desjardins executed net start and sc query to enumerate installed antivirus services before deploying ransomware."
U.S. District Court for the Middle District of Florida · 8:20-cr-00366
View full case dossier →
Commonly Charged Criminal Statutes
18 U.S.C. § 1030(a)(5)(A)
Intentional Damage to a Protected Computer
Prohibits knowingly causing the transmission of a program, information, code, or command that intentionally causes damage without authorization to a protected computer.
18 U.S.C. § 1030(a)(7)
Extortion in Connection with Computers
Prohibits transmitting in interstate or foreign commerce threats to cause damage to a protected computer or obtain confidential information with intent to extort money or value.
18 U.S.C. § 1956
Money Laundering
Prohibits conducting financial transactions knowing that the property involved represents the proceeds of unlawful activity to promote unlawful activity or conceal the nature or ownership of the proceeds.