Remote Service Activity via SVCCTL Named Pipe

Title: Remote Service Activity via SVCCTL Named Pipe
Status: test
Description:Detects remote service activity via remote access to the svcctl named pipe
References:
  -https://web.archive.org/web/20230329155141/https://blog.menasec.net/2019/03/threat-hunting-26-remote-windows.html
Author: Samir Bousseaden
Date: 2019-04-03
modified:2024-08-01
Tags:

• -'attack.lateral-movement'
• -'attack.persistence'
• -'attack.t1021.002'

Logsource:

• product: windows
• service: security
• definition: The advanced audit policy setting "Object Access > Audit Detailed File Share" must be configured for Success/Failure

Detection:
  selection:
    EventID: '5145'
    ShareName: '\\\\\*\\IPC$'
    RelativeTargetName: 'svcctl'
    AccessList|contains: 'WriteData'
  condition:selection
Falsepositives:
  -Unknown
Level: medium