volatility3 svcscan

vol.py -f mem.dmp windows.svcscan

Enumerates Windows services registered in the memory dump, detecting anomalous services installed by the attacker for persistence.

Run it when you want to know which services were registered at the time of the dump: svcscan walks the kernel's service structure (not the registry, the in-memory view) and lists each service with its binary, type, and state. The finding is the service that shouldn't exist: an innocuous name (Update, Monitor) with the binary in Temp or in a user directory — the attacker's service persistence. In memory IR, svcscan is the persistence piece: pslist tells you what's running, svcscan tells you what's registered to run.

Don't use it as a complete persistence inventory: svcscan sees services registered in memory — those that are registered and deleted (attackers sometimes clean up), persistence via other means (Run keys, tasks, WMI) doesn't show up; for the full picture combine with the registry (autoruns) and scheduled tasks. The service list on a Windows system is long and Microsoft names repeat: filter for binaries outside System32 and for services whose executable doesn't exist. And note: the service binary is the key field — a system service pointing to a user path is the direct finding.