From d62bc41bfbd3fbf9daff268f545d095a21489c2d Mon Sep 17 00:00:00 2001
From: sbousseaden <bousseaden.samir@gmail.com>
Date: Wed, 3 Apr 2019 13:58:20 +0200
Subject: [PATCH] Create win_svcctl_remote_service.yml

---
 .../builtin/win_svcctl_remote_service.yml     | 22 +++++++++++++++++++
 1 file changed, 22 insertions(+)
 create mode 100644 rules/windows/builtin/win_svcctl_remote_service.yml

diff --git a/rules/windows/builtin/win_svcctl_remote_service.yml b/rules/windows/builtin/win_svcctl_remote_service.yml
new file mode 100644
index 000000000..9dd59a0d8
--- /dev/null
+++ b/rules/windows/builtin/win_svcctl_remote_service.yml
@@ -0,0 +1,22 @@
+title: Remote Service Activity Detected via SVCCTL named pipe
+description: Detects remote remote service activity via remote access to the svcctl named pipe
+author: Samir Bousseaden
+references:
+    - https://blog.menasec.net/2019/03/threat-hunting-26-remote-windows.html
+tags:
+    - attack.lateral_movement
+    - attack.persistence
+logsource:
+    product: windows
+    service: security
+    description: 'The advanced audit policy setting "Object Access > Audit Detailed File Share" must be configured for Success/Failure'
+detection:
+    selection:
+        EventID: 5145
+        ShareName: \\*\IPC$
+        RelativeTargetName: svcctl
+        Accesses: '*WriteData*'
+    condition: selection
+falsepositives: 
+    - pentesting
+level: medium