detection.wiki

Detection rules › Sigma

Massive service installation - Tchopper

Status
experimental
Severity
high
Time window
20m
Log source
product windows, service system
Author
mdecrevoisier
Source
github.com/mdecrevoisier/SIGMA-detection-rules

Detects scenarios where an attacker uses the Tchopper tool by abusing the display name of a service as a placeholder to upload an obfuscated payload. Service name may come with very high entropy. Option mode "-m" will not report any service installation, only service failures.

MITRE ATT&CK coverage

TacticTechniques
ExecutionT1569 System Services

Event coverage

ProviderEvent
Service-Control-ManagerEvent ID 7045

Rule body yaml

title: Massive service installation - Tchopper
description: Detects scenarios where an attacker uses the Tchopper tool by abusing the display name of a service as a placeholder to upload an obfuscated payload. Service name may come with very high entropy. Option mode "-m" will not report any service installation, only service failures.
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0002-Execution/T1569.002-Service%20execution
- https://github.com/lawrenceamer/TChopper
tags:
- attack.execution
- attack.t1569
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  service: system
detection:
  selection:
    EventID: 7045 # service installation
    #ImagePath|contains|all: # May not be necessary as deploying a high number of services is already suspicious
    #  - cmd
    #  - powershell
    #  - Get-Service
    #  - out-file
  condition: selection | count(ServiceName) by Computer > 50 # Count how many different services are deployed on the host.
  timeframe: 20m
falsepositives:
- None
level: high

Stages and Predicates

Stage 0: condition

selection | count(ServiceName) by Computer > 50 # Count how many different services are deployed on the host.

Stage 1: selection

selection:
  EventID: 7045
Threshold
> 50