Remote enumeration pipe
A remote client opened one of the named pipes used to enumerate a host: who is logged on, what is shared, and which accounts exist. * \srvsvc …
What it detects
A remote client opened one of the named pipes used to enumerate a host: who is logged on, what is shared, and which accounts exist.
* \srvsvc — NetSessionEnum and NetShareEnum. This is how BloodHound and PowerView's Invoke-UserHunter find WHERE a target user is currently logged on, which is how an operator decides which machine to take next. * \wkssvc — NetWkstaUserEnum, the same question asked a different way. * \browser — legacy network browsing. * \samr / \lsarpc — account and policy enumeration.
Kept LOW and marked experimental deliberately. Ordinary file sharing opens \srvsvc constantly, so on its own this is close to background noise; its value is as corroboration when an account is already under suspicion, and as the thing that makes a user-hunting sweep visible once several hosts report it from one source. Unlike the pipes in windows.lateral_movement.admin_share_remote_exec_pipe, none of these grants control — they only answer questions.
NOTE: this rule's false-positive rate is NOT measured. The benign benchmark corpus contains no Sysmon data, so the estimate above is judgement, not evidence.
MITRE ATT&CK mapping
False positives and triage
Expect a high background rate: every SMB share browse, every logon script, every inventory sweep opens these. Do not triage individual events.
Use it in aggregate instead. One source touching these pipes on MANY hosts in a short window is a user-hunting sweep and is worth acting on; the same pipe opened once by a file server's normal clients is not. If your estate has a management server that enumerates sessions by design, baseline it and treat everything else as the signal. If Sysmon pipe events prove too noisy in your environment, disable this rule rather than raising its severity — it is explicitly the low-confidence end of the pack.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 40%. Source: rules/windows/remote_enumeration_pipe.yaml, licensed under the Apache License 2.0.
id: windows.discovery.remote_enumeration_pipe
version: 1.0.0
status: experimental
severity: low
confidence: 0.4
platforms: [windows]
mitre_techniques: [T1049, T1135, T1087.002]
description: |
A remote client opened one of the named pipes used to enumerate a host: who is
logged on, what is shared, and which accounts exist.
* `\srvsvc` — `NetSessionEnum` and `NetShareEnum`. This is how BloodHound and
PowerView's `Invoke-UserHunter` find WHERE a target user is currently logged
on, which is how an operator decides which machine to take next.
* `\wkssvc` — `NetWkstaUserEnum`, the same question asked a different way.
* `\browser` — legacy network browsing.
* `\samr` / `\lsarpc` — account and policy enumeration.
Kept LOW and marked experimental deliberately. Ordinary file sharing opens
`\srvsvc` constantly, so on its own this is close to background noise; its value
is as corroboration when an account is already under suspicion, and as the thing
that makes a user-hunting sweep visible once several hosts report it from one
source. Unlike the pipes in
`windows.lateral_movement.admin_share_remote_exec_pipe`, none of these grants
control — they only answer questions.
NOTE: this rule's false-positive rate is NOT measured. The benign benchmark corpus
contains no Sysmon data, so the estimate above is judgement, not evidence.
match:
event_action: named_pipe
file_path_contains_any:
- '\srvsvc'
- '\wkssvc'
- '\browser'
- '\samr'
- '\lsarpc'
correlation_keys: [hostname]
false_positive_guidance: |
Expect a high background rate: every SMB share browse, every logon script, every
inventory sweep opens these. Do not triage individual events.
Use it in aggregate instead. One source touching these pipes on MANY hosts in a
short window is a user-hunting sweep and is worth acting on; the same pipe opened
once by a file server's normal clients is not. If your estate has a management
server that enumerates sessions by design, baseline it and treat everything else
as the signal. If Sysmon pipe events prove too noisy in your environment, disable
this rule rather than raising its severity — it is explicitly the low-confidence
end of the pack.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.