Network investigation guide

Investigating Service Enumeration

Service enumeration is repeated querying of a directory or network service to list accounts, shares, devices, permissions, or other useful resources.

Discovery and enumeration MITRE ATT&CK: T1046 Network Service Discovery

What does Service Enumeration mean?

Attackers enumerate services to shorten the path to privilege escalation and lateral movement. Identity synchronization, inventory, backup, and monitoring tools can generate similar high-volume queries.

How to investigate Service Enumeration

  1. 1

    Identify the queried protocol, service, and type of information requested.

  2. 2

    Determine whether the source process and host normally perform bulk queries.

  3. 3

    Compare the activity with approved schedules and historical volume.

  4. 4

    Look for use of discovered accounts, shares, services, or privileges afterward.

Common benign explanations

Finding this behavior does not by itself prove malicious intent. Common explanations include:

  • Identity, directory synchronization, or IAM services
  • Asset inventory, vulnerability scanning, and endpoint management
  • Backup, indexing, SNMP, and network monitoring jobs

When to escalate or de-escalate

Escalate when

  • A user endpoint or unusual process performs broad directory, share, or service queries.
  • Enumeration is followed by credential access, remote service use, or lateral movement.

De-escalate when

  • The activity matches a sanctioned synchronization, inventory, backup, or monitoring task.
  • The query scope and timing are consistent with established behavior.

Investigate network behavior with Red Hand

Red Hand turns network traffic into a report that identifies meaningful behavior, adds endpoint and process context when available, and provides practical investigation guidance.