Massive remote service creation via named pipes (TChopper, CME)

Detects scenarios where an attacker remotely creates a service over named pipes. Tools like Tchopper or CrackMapExec can trigger this rule.