Detection of Windows Service Enumeration via Net Start

Adversaries often use the built-in Windows utility 'net start' to enumerate running services on a target system. This activity, classified under System Service Discovery (T1007), allows attackers to identify active security software, map operational services, and uncover potential opportunities for privilege escalation or lateral movement. While 'net start' is a standard administrative tool, its execution by non-administrative users or in conjunction with other reconnaissance tools (such as 'tasklist' or 'sc query') is a common indicator of post-exploitation activity. This behavior has been observed in campaigns utilizing malware such as Gh0st RAT and LAMEHUG. Security teams should monitor endpoint process telemetry for command-line arguments containing 'start' to identify unauthorized reconnaissance activity.

Impact

Successful service discovery provides attackers with the necessary intelligence to tailor their follow-on actions, such as disabling security controls or targeting specific services for exploitation. This reconnaissance can occur early in the attack lifecycle, allowing adversaries to move faster while remaining undetected within the environment.

Recommendation

• Deploy the provided Sigma rule to your SIEM to monitor for suspicious 'net start' command execution.
• Enable Sysmon Event ID 1 (Process Creation) or Windows Security Event ID 4688 to ensure full command-line visibility across all endpoints.
• Correlate alerts for 'net start' with other discovery commands, such as 'tasklist.exe' or 'sc.exe', to increase detection fidelity.
• Baseline 'net start' usage within your environment to identify and suppress noise generated by legitimate administrative scripts and automated maintenance tasks.