Skip to main content

​
Overview

The Services command enumerates Windows services on the system. By default, it filters out Microsoft-signed services to highlight potentially interesting third-party services, custom services, and security products. Use the -full flag to enumerate all services without filtering.

​
Syntax

# Filter out Microsoft services (default)
Seatbelt.exe Services

# Enumerate all services
Seatbelt.exe Services -full
This command does not support remote execution for standard enumeration.

​
Output

Returns service information:
  • Service name
  • Display name
  • Company name
  • Service state (Running, Stopped)
  • Start type (Auto, Manual, Disabled)
  • Service path
  • Service account

​
Use Cases

  • Red Team
  • Blue Team
  • Identify security products and monitoring services
  • Find services running as SYSTEM or privileged accounts
  • Discover unquoted service paths
  • Locate modifiable service binaries
  • Identify services for persistence

​
Example Output

====== Services ======

Name         : Sysmon64
DisplayName  : Sysmon64
CompanyName  : Sysinternals - www.sysinternals.com
State        : Running
StartMode    : Auto
PathName     : C:\Windows\sysmon64.exe
ServiceAccount: LocalSystem

Name         : CustomBackup
DisplayName  : Custom Backup Service
CompanyName  : Custom Software Inc.
State        : Running
StartMode    : Auto
PathName     : "C:\Program Files\CustomBackup\BackupService.exe"
ServiceAccount: NT AUTHORITY\SYSTEM

Name         : VulnService
DisplayName  : Vulnerable Service
CompanyName  :
State        : Running
StartMode    : Auto
PathName     : C:\Program Files\Vulnerable App\service.exe
ServiceAccount: LocalSystem
[!] Unquoted service path detected

​
Remote Execution

This command does NOT support remote execution.

​
Detection Considerations

Low detection risk - service enumeration is common administrative activity.
  • API Calls: Uses Service Control Manager (SCM) APIs
  • WMI Queries: May use WMI for additional service details
  • EDR Telemetry: Service enumeration may be logged