Detection rules › Sigma

Massive remote service creation via named pipes - Tchopper

Status
experimental
Severity
high
Time window
20m
Log source
product windows, service security
Author
mdecrevoisier
Source
github.com/mdecrevoisier/SIGMA-detection-rules

Detects scenarios where an attacker uses the Tchopper tool by remotely creating multiple services via named pipes.

Known false positives

  • None

MITRE ATT&CK coverage

TacticTechniques
Execution

Telemetry coverage

Rule body

title: Massive remote service creation via named pipes - Tchopper
description: Detects scenarios where an attacker uses the Tchopper tool by remotely creating multiple services via named pipes.
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0002-Execution/T1569.002-Service%20execution
- https://github.com/lawrenceamer/TChopper
tags:
- attack.execution
- attack.t1569
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 5145
    ShareName: '\\*\IPC$'
    RelativeTargetName: svcctl
    AccessList|contains: '%%4417' # WriteData
  condition: selection | count(EventRecordID) by Computer > 100
  timeframe: 20m
falsepositives:
- None
level: high

Stages and Predicates

Stage 0: condition

selection | count(EventRecordID) by Computer > 100

Stage 1: selection

selection:
  EventID: 5145
  ShareName: '\\*\IPC$'
  RelativeTargetName: svcctl
  AccessList|contains: '%%4417'
Threshold
> 100

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
AccessListmatch
  • %%4417 corpus 11 (sigma 8, elastic 2, splunk 1)
field:"AccessList" kind:match value:"%%4417"
RelativeTargetNameeq
  • svcctl corpus 6 (sigma 5, kusto 1)
field:"RelativeTargetName" kind:eq value:"svcctl"
ShareNamewildcard
  • \\*\IPC$ corpus 11 (sigma 11)
field:"ShareName" kind:wildcard value:"\\*\IPC$"