Detection rules › Sigma
Obfuscated payload transfered via service name - Tchopper (command)
Detects scenarios where an attacker uses the Tchopper tool by abusing the display name of a service as a placeholder to upload an obfuscated payload. With this command, attacker appends the current service name to a file.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Stealth | T1027 Obfuscated Files or Information |
Event coverage
| Provider | Event | Title |
|---|---|---|
| Security-Auditing | Event ID 4688 | A new process has been created. |
Rule body yaml
title: Obfuscated payload transfered via service name - Tchopper (command)
description: Detects scenarios where an attacker uses the Tchopper tool by abusing the display name of a service as a placeholder to upload an obfuscated payload. With this command, attacker appends the current service name to a file.
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0005-Defense%20Evasion/T1027-Obfuscated%20Files%20or%20Information
- https://github.com/lawrenceamer/TChopper
tags:
- attack.defense_evasion
- attack.t1027
author: mdecrevoisier
status: experimental
logsource:
product: windows
category: process_creation
detection: # Full command: "powershell -command "Get-Service "seg243" | select -Expand DisplayName |out-file -append tmp_payload.txt""
selection:
EventID: 4688
#ParentProcessName|endswith: # Only for informational purpose
# - \services.exe
# - \cmd.exe
#Version: 2
NewProcessName|endswith:
- '\cmd.exe' # Process spawned by \services.exe
- '\powershell.exe' # Process spwaned by \cmd.exe
CommandLine|contains|all:
- powershell
- command
- out-file
- append
#- Get-Service # not present using the WMI mode
condition: selection | count(EventRecordID) by Computer > 50
timeframe: 20m
falsepositives:
- None
level: high
Stages and Predicates
Stage 0: condition
selection | count(EventRecordID) by Computer > 50Stage 1: selection
selection:
EventID: 4688
NewProcessName|endswith:
- '\cmd.exe'
- '\powershell.exe'
CommandLine|contains|all:
- powershell
- command
- out-file
- append
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
CommandLine | match |
|
NewProcessName | ends_with |
|