Remote service creation via named pipes

Status: experimental
Severity: medium
Log source: product windows, service security
Author: mdecrevoisier
Source: github.com/mdecrevoisier/SIGMA-detection-rules

Detects scenarios where an attacker remotely creates a service over named pipes. Tools like Tchopper or CrackMapExec can trigger this rule.

Known false positives

Administrator activity, backup solutions

MITRE ATT&CK coverage

Tactic	Techniques
Execution	`T1569` System Services

Telemetry coverage

Provider	Record / event type
Security-Auditing	Event ID 5145: A network share object was checked to see whether client can be granted desired access.

Rule body

title: Remote service creation via named pipes
description: Detects scenarios where an attacker remotely creates a service over named pipes. Tools like Tchopper or CrackMapExec can trigger this rule.
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0002-Execution/T1569.002-Service%20execution
tags:
- attack.execution
- attack.t1569
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 5145
    ShareName: '\\*\IPC$'
    RelativeTargetName: svcctl
    AccessList|contains: '%%4417' # WriteData
  filter:
    SubjectUserName|endswith: '$'
  condition: selection and not filter
falsepositives:
- Administrator activity, backup solutions
level: medium

Stages and Predicates

Stage 0: `condition`

selection and not filter

Stage 1: `selection`

selection:
  EventID: 5145
  ShareName: '\\*\IPC$'
  RelativeTargetName: svcctl
  AccessList|contains: '%%4417'

Stage 2: `not filter`

filter:
  SubjectUserName|endswith: '$'

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`SubjectUserName`	ends_with	`$`	`excludes:SubjectUserName` `field:"SubjectUserName" value:"$"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`AccessList`	match	`%%4417` corpus 11 (sigma 8, elastic 2, splunk 1)	`field:"AccessList" kind:match value:"%%4417"`
`RelativeTargetName`	eq	`svcctl` corpus 6 (sigma 5, kusto 1)	`field:"RelativeTargetName" kind:eq value:"svcctl"`
`ShareName`	wildcard	`\\*\IPC$` corpus 11 (sigma 11)	`field:"ShareName" kind:wildcard value:"\\*\IPC$"`