Obfuscated payload transfered via service name - Tchopper (command)

title: Obfuscated payload transfered via service name - Tchopper (command)
description: Detects scenarios where an attacker uses the Tchopper tool by abusing the display name of a service as a placeholder to upload an obfuscated payload. With this command, attacker appends the current service name to a file.
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0005-Defense%20Evasion/T1027-Obfuscated%20Files%20or%20Information
- https://github.com/lawrenceamer/TChopper
tags:
- attack.defense_evasion
- attack.t1027
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  category: process_creation
detection: # Full command: "powershell -command "Get-Service "seg243" | select -Expand DisplayName |out-file -append tmp_payload.txt""
  selection:
    EventID: 4688
    #ParentProcessName|endswith: # Only for informational purpose
    #  - \services.exe
    #  - \cmd.exe
    #Version: 2
    NewProcessName|endswith:
      - '\cmd.exe'        # Process spawned by \services.exe
      - '\powershell.exe' # Process spwaned by \cmd.exe
    CommandLine|contains|all:
      - powershell
      - command
      - out-file
      - append
      #- Get-Service # not present using the WMI mode
  condition: selection | count(EventRecordID) by Computer > 50
  timeframe: 20m
falsepositives:
- None
level: high