Massive remote service creation via named pipes (TChopper, CME)

Status: experimental
Severity: high
Log source: product windows, service security
Author: mdecrevoisier
Source: github.com/mdecrevoisier/SIGMA-detection-rules

Detects scenarios where an attacker remotely creates a service over named pipes. Tools like Tchopper or CrackMapExec can trigger this rule.

Known false positives

Administrator activity, backup solutions

MITRE ATT&CK coverage

Tactic	Techniques
Execution	`T1569` System Services

Telemetry coverage

Provider	Record / event type
Security-Auditing	Event ID 5145: A network share object was checked to see whether client can be granted desired access.

Rule body

title: Massive remote service creation via named pipes (TChopper, CME)
description: Detects scenarios where an attacker remotely creates a service over named pipes. Tools like Tchopper or CrackMapExec can trigger this rule.
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0002-Execution/T1569.002-Service%20execution
- https://github.com/lawrenceamer/TChopper
tags:
- attack.execution
- attack.t1569
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 5145
    ShareName: '\\*\IPC$'
    RelativeTargetName: svcctl
    AccessList|contains: '%%4417' # WriteData
  filter:
    SubjectUserName|endswith: '$'
  condition: selection and not filter | count(Computer) by IpAddress > 20
falsepositives:
- Administrator activity, backup solutions
level: high

Stages and Predicates

Stage 0: `condition`

selection and not filter | count(Computer) by IpAddress > 20

Stage 1: `selection`

selection:
  EventID: 5145
  ShareName: '\\*\IPC$'
  RelativeTargetName: svcctl
  AccessList|contains: '%%4417'

Threshold: > 20

Stage 2: `not filter`

filter:
  SubjectUserName|endswith: '$'

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`SubjectUserName`	ends_with	`$`	`excludes:SubjectUserName` `field:"SubjectUserName" value:"$"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`AccessList`	match	`%%4417` corpus 11 (sigma 8, elastic 2, splunk 1)	`field:"AccessList" kind:match value:"%%4417"`
`RelativeTargetName`	eq	`svcctl` corpus 6 (sigma 5, kusto 1)	`field:"RelativeTargetName" kind:eq value:"svcctl"`
`ShareName`	wildcard	`\\*\IPC$` corpus 11 (sigma 11)	`field:"ShareName" kind:wildcard value:"\\*\IPC$"`