Service enumeration via sc query, net start, WMI or Get-Service

Siemphony@siemphonylowT1007unverified

Matches the command shapes AN1325 names for reading the registered service table: `sc query`, `tasklist /svc`, a bare `net start`, `wmic service`, and the PowerShell/CIM equivalents. Each leg pairs the binary with the argument that makes it an enumeration, so `sc.exe create` and `net start <ServiceName>` — which write rather than read — stay outside it; the `net` leg anchors on the command line ending at the verb, which is what excludes starting a named service and also what makes it miss a redirected `net start > out.txt`. The brief offers Security EventID 4688 for this analytic but maps it onto the Sysmon-shaped `process_creation` category, and the rule is written in that vocabulary (`Image`, `CommandLine`); a 4688 feed needs `NewProcessName` mapped onto `Image` and `ProcessCommandLine` onto `CommandLine` before it can match, and 4688 itself requires *Audit Process Creation* plus the separate *Include command line in process creation events* policy, neither of which is enabled by a default install or by the MS/CIS baselines. AN1325's other log source, the PowerShell 4103/4104 channel, is not used, so the cmdlet leg only sees `Get-Service` and the CIM/WMI equivalents when they are carried on a new process's command line; the same cmdlet typed into a session already running, or called from inside a script, creates no process and is invisible here — a quiet result is not evidence that nothing enumerated the services. MITRE's `CommandLineMatch` knob is what the argument gates implement, populated here with the verbs above. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0483, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where ((FolderPath endswith "\\sc.exe" and ProcessCommandLine contains "query") or (FolderPath endswith "\\tasklist.exe" and (ProcessCommandLine contains "-svc" or ProcessCommandLine contains "/svc" or ProcessCommandLine contains "–svc" or ProcessCommandLine contains "—svc" or ProcessCommandLine contains "―svc")) or ((FolderPath endswith "\\net.exe" or FolderPath endswith "\\net1.exe") and ProcessCommandLine endswith " start") or (FolderPath endswith "\\wmic.exe" and ProcessCommandLine contains "service") or (ProcessCommandLine contains "Get-Service" or ProcessCommandLine contains "Get-CimInstance -ClassName Win32_Service" or ProcessCommandLine contains "Get-CimInstance Win32_Service" or ProcessCommandLine contains "Get-WmiObject -Class Win32_Service" or ProcessCommandLine contains "Get-WmiObject Win32_Service"))

Splunk · SPL

Run this as a search.

index=* ((Image="*\\sc.exe" AND CommandLine="*query*") OR (Image="*\\tasklist.exe" AND (CommandLine="*-svc*" OR CommandLine="*/svc*" OR CommandLine="*–svc*" OR CommandLine="*—svc*" OR CommandLine="*―svc*")) OR ((Image="*\\net.exe" OR Image="*\\net1.exe") AND CommandLine="* start") OR (Image="*\\wmic.exe" AND CommandLine="*service*") OR (CommandLine="*Get-Service*" OR CommandLine="*Get-CimInstance -ClassName Win32_Service*" OR CommandLine="*Get-CimInstance Win32_Service*" OR CommandLine="*Get-WmiObject -Class Win32_Service*" OR CommandLine="*Get-WmiObject Win32_Service*"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((TO_LOWER(process.executable) LIKE "*\\\\sc.exe" AND TO_LOWER(process.command_line) LIKE "*query*") OR (TO_LOWER(process.executable) LIKE "*\\\\tasklist.exe" AND (TO_LOWER(process.command_line) LIKE "*-svc*" OR TO_LOWER(process.command_line) LIKE "*/svc*" OR TO_LOWER(process.command_line) LIKE "*–svc*" OR TO_LOWER(process.command_line) LIKE "*—svc*" OR TO_LOWER(process.command_line) LIKE "*―svc*")) OR ((TO_LOWER(process.executable) LIKE "*\\\\net.exe" OR TO_LOWER(process.executable) LIKE "*\\\\net1.exe") AND TO_LOWER(process.command_line) LIKE "* start") OR (TO_LOWER(process.executable) LIKE "*\\\\wmic.exe" AND TO_LOWER(process.command_line) LIKE "*service*") OR (TO_LOWER(process.command_line) LIKE "*get-service*" OR TO_LOWER(process.command_line) LIKE "*get-ciminstance -classname win32_service*" OR TO_LOWER(process.command_line) LIKE "*get-ciminstance win32_service*" OR TO_LOWER(process.command_line) LIKE "*get-wmiobject -class win32_service*" OR TO_LOWER(process.command_line) LIKE "*get-wmiobject win32_service*"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <!-- 5 rules: the Sigma condition ORs across different fields,       which one rule cannot express. Any one matching is a hit. -->  <rule id="100000" level="5">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)\\sc\.exe$</field>    <field name="CommandLine" type="pcre2">(?i)query</field>    <description>Service enumeration via sc query, net start, WMI or Get-Service (1/5)</description>    <mitre>      <id>T1007</id>    </mitre>  </rule>   <rule id="100001" level="5">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)\\tasklist\.exe$</field>    <field name="CommandLine" type="pcre2">(?i)(-svc|/svc|–svc|—svc|―svc)</field>    <description>Service enumeration via sc query, net start, WMI or Get-Service (2/5)</description>    <mitre>      <id>T1007</id>    </mitre>  </rule>   <rule id="100002" level="5">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)(\\net\.exe$|\\net1\.exe$)</field>    <field name="CommandLine" type="pcre2">(?i) start$</field>    <description>Service enumeration via sc query, net start, WMI or Get-Service (3/5)</description>    <mitre>      <id>T1007</id>    </mitre>  </rule>   <rule id="100003" level="5">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)\\wmic\.exe$</field>    <field name="CommandLine" type="pcre2">(?i)service</field>    <description>Service enumeration via sc query, net start, WMI or Get-Service (4/5)</description>    <mitre>      <id>T1007</id>    </mitre>  </rule>   <rule id="100004" level="5">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="CommandLine" type="pcre2">(?i)(Get-Service|Get-CimInstance -ClassName Win32_Service|Get-CimInstance Win32_Service|Get-WmiObject -Class Win32_Service|Get-WmiObject Win32_Service)</field>    <description>Service enumeration via sc query, net start, WMI or Get-Service (5/5)</description>    <mitre>      <id>T1007</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: low
Category: discovery_recon
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 3b4ea06f-1570-4df8-b597-91fe241c2480

ATT&CKT1007

T1007System Service Discovery

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessondiscovery recon

discovery reconAI draft — unreviewed

01 · What this rule detects

The command shapes AN1325 names for reading the registered service table on Windows: sc query, tasklist /svc, a bare net start, wmic service, and the PowerShell/CIM equivalents. Each leg pairs a binary with the argument that makes the invocation a read rather than a write, so sc.exe create and net start <ServiceName> stay outside it. AN1325 also names the WMI and PowerShell API path, but this rule sees that only where it surfaces on a new process's command line.

02 · Telemetry you need

Windows process creation. The brief offers Security EventID 4688 and maps it onto the Sysmon-shaped process_creation category; the rule is written in that vocabulary — Image, CommandLine. A 4688 feed needs NewProcessName mapped onto Image and ProcessCommandLine onto CommandLine before a single leg can match. 4688 also requires Audit Process Creation, and its command line needs the separate Include command line in process creation events policy; neither is on in a default install or in the MS/CIS baselines. AN1325's other log source, the PowerShell 4103/4104 channel, is unused, so a cmdlet typed into a running session or called from inside a .ps1 is invisible here. An empty result means blind, not quiet.

03 · How the logic works

Four legs are two-field gates. Only the cmdlet leg is command-line-only, because gating it on powershell.exe would drop pwsh.exe and custom .NET runspace hosts. windash on the tasklist leg covers /svc, -svc and the Unicode dash variants. The net leg anchors with endswith ' start' — that anchor is what excludes starting a named service, and it is also the rule's most brittle gate: net start > out.txt, net start | findstr, a trailing space, or cmd /c net start & sc query all slip past it. net1.exe is listed because net.exe re-execs into it.

04 · Common false positives

Loudest by a wide margin: monitoring, inventory and RMM agents polling service state on a schedule — a Nagios or Zabbix check, a configuration-management run, a health script calling Get-Service on every host every few minutes. Then installers and MSI custom actions running sc query <ServiceName> to test whether their own service already exists, and backup or asset-discovery products sweeping Win32_Service over WMI. Two substring gates over-reach. wmic service is a bare contains, so it also matches wmic service where name='x' call stopservice — service stop, which is T1489, not discovery — and any class path embedding the token, such as Win32_TerminalServiceSetting. The cmdlet leg matches that literal text anywhere, so a shortcut or scheduled task pointing at Get-ServiceReport.ps1 counts too.

05 · Detection maturity

tier_1: Lowest tier, and it stays there. This rule is authored, not extracted — MITRE ships no query logic — and it has never been executed against a single log line. It cannot be rated above the bottom of any maturity model until someone runs it on real telemetry, confirms the field mapping actually populates, and measures the false-positive rate that first entry predicts. Treat it as a scaffold to test and own, not a detection to deploy.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

MITRE gives AN1325 three knobs. ProcessName is where the binary gates live; CommandLineMatch is what the argument gates implement, populated here with the verbs above — those values are the pipeline's own, not MITRE's. ParentProcess is the one that pays: baseline the parents your agents spawn checks under, add them as a filter, and most of the volume disappears. Narrowing the wmic leg to the enumeration verbs (service list, service get, path win32_service) removes the T1489 overlap, at the cost of missing a bare wmic service.

Declared by the author

Monitoring, inventory and RMM agents polling service state on a schedule — a configuration-management run, a Nagios or Zabbix check, or a health script calling Get-Service or sc query on every host every few minutes. This is the highest-volume match by a wide margin and is why the rule is not rated above low; MITRE's ParentProcess knob is the place to suppress it, keyed on the agent that spawns the check.
Software installers, updaters and MSI custom actions running sc query <ServiceName> to test whether their own service already exists before installing, repairing or upgrading it.
Backup, antivirus and asset-discovery products enumerating Win32_Service over WMI or CIM as part of a routine inventory sweep.
Helpdesk and administrator troubleshooting during an incident, where tasklist /svc and net start are typed interactively to work out which service owns a hung process.

Noise checkfires on 2 of 30

Fires on 2 of 30 ordinary behaviours the baseline holds for this log type. Each is something a managed estate does on purpose, so each is a false positive an analyst would have to close.

pc-sc-query-monitoring
A monitoring agent polling service state.
pc-tasklist-monitoring
Process enumeration by a monitoring agent — the same call an attacker makes for discovery.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
0 true · 2 false · 100.0% noise

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1007, evaluated against their process_creation events.

Share this rule

/u/siemphony/3b4ea06f-1570-4df8-b597-91fe241c2480

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Service enumeration via sc query, net start, WMI or Get-Service

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it