detection.wiki

Detection rules › Sigma

Massive service failures - Tchopper

Status
experimental
Severity
high
Time window
20m
Log source
product windows, service system
Author
mdecrevoisier
Source
github.com/mdecrevoisier/SIGMA-detection-rules

Detects scenarios where an attacker uses the Tchopper tool by abusing the display name of a service as a placeholder to upload an obfuscated payload. Service name may come with very high entropy.

MITRE ATT&CK coverage

TacticTechniques
ExecutionT1569 System Services

Rule body yaml

title: Massive service failures - Tchopper
description: Detects scenarios where an attacker uses the Tchopper tool by abusing the display name of a service as a placeholder to upload an obfuscated payload. Service name may come with very high entropy.
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0002-Execution/T1569.002-Service%20execution
- https://github.com/lawrenceamer/TChopper
tags:
- attack.execution
- attack.t1569
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  service: system
detection:
  selection:
    EventID:
      - 7000 # EVENT_SERVICE_START_FAILED
      - 7009 # EVENT_CONNECTION_TIMEOUT
  condition: selection | count(EventRecordID) by Computer > 100 # Count how many services failures are reported on the host.
  timeframe: 20m
falsepositives:
- Missconfigured services
level: high

Stages and Predicates

Stage 0: condition

selection | count(EventRecordID) by Computer > 100 # Count how many services failures are reported on the host.

Stage 1: selection

selection:
  EventID:
    - 7000
    - 7009
Threshold
> 100