Obfuscated payload transfered via service name - Tchopper (command)

Detects scenarios where an attacker uses the Tchopper tool by abusing the display name of a service as a placeholder to upload an obfuscated payload. With this command, attacker appends the current service name to a file.