Network investigation guide
Investigating Service Enumeration
Service enumeration is repeated querying of a directory or network service to list accounts, shares, devices, permissions, or other useful resources.
Understand the finding
What does Service Enumeration mean?
Attackers enumerate services to shorten the path to privilege escalation and lateral movement. Identity synchronization, inventory, backup, and monitoring tools can generate similar high-volume queries.
Triage workflow
How to investigate Service Enumeration
- 1
Identify the queried protocol, service, and type of information requested.
- 2
Determine whether the source process and host normally perform bulk queries.
- 3
Compare the activity with approved schedules and historical volume.
- 4
Look for use of discovered accounts, shares, services, or privileges afterward.
Interpret the context
Common benign explanations
Finding this behavior does not by itself prove malicious intent. Common explanations include:
- Identity, directory synchronization, or IAM services
- Asset inventory, vulnerability scanning, and endpoint management
- Backup, indexing, SNMP, and network monitoring jobs
Make a decision
When to escalate or de-escalate
Escalate when
- A user endpoint or unusual process performs broad directory, share, or service queries.
- Enumeration is followed by credential access, remote service use, or lateral movement.
De-escalate when
- The activity matches a sanctioned synchronization, inventory, backup, or monitoring task.
- The query scope and timing are consistent with established behavior.
Analyze the evidence
Investigate network behavior with Red Hand
Red Hand turns network traffic into a report that identifies meaningful behavior, adds endpoint and process context when available, and provides practical investigation guidance.