{"id":"41504465-5e3a-4a5b-a5b4-2a0baadd4463","title":"PsExec Tool Execution From Suspicious Locations - PipeName","description":"Detects PsExec default pipe creation where the image executed is located in a suspicious location. Which could indicate that the tool is being used in an attack","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2022-08-04","modified":"2023-09-20","tags":["attack.execution","attack.t1569.002","attack.s0029"],"technique_ids":["T1569.002"],"logsource":{"category":"pipe_created","product":"windows","definition":"Note that you have to configure logging for Named Pipe Events in Sysmon config (Event ID 17 and Event ID 18). The basic configuration is in popular sysmon configuration (https://github.com/SwiftOnSecurity/sysmon-config), but it is worth verifying. You can also use other repo, e.g. https://github.com/Neo23x0/sysmon-config, https://github.com/olafhartong/sysmon-modular. How to test detection? You can check powershell script from this site https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575"},"falsepositives":["Rare legitimate use of psexec from the locations mentioned above. This will require initial tuning based on your environment."],"references":["https://www.jpcert.or.jp/english/pub/sr/ir_research.html","https://jpcertcc.github.io/ToolAnalysisResultSheet"],"source_path":"rules/windows/pipe_created/pipe_created_sysinternals_psexec_default_pipe_susp_location.yml","source_sha256":"c097cd5facb6e79504635b658ba8b169680a75c6a03ddd2a744f310d32cae932","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/pipe_created/pipe_created_sysinternals_psexec_default_pipe_susp_location.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: PsExec Tool Execution From Suspicious Locations - PipeName\nid: 41504465-5e3a-4a5b-a5b4-2a0baadd4463\nrelated:\n    - id: f3f3a972-f982-40ad-b63c-bca6afdfad7c\n      type: derived\nstatus: test\ndescription: Detects PsExec default pipe creation where the image executed is located in a suspicious location. Which could indicate that the tool is being used in an attack\nreferences:\n    - https://www.jpcert.or.jp/english/pub/sr/ir_research.html\n    - https://jpcertcc.github.io/ToolAnalysisResultSheet\nauthor: Nasreddine Bencherchali (Nextron Systems)\ndate: 2022-08-04\nmodified: 2023-09-20\ntags:\n    - attack.execution\n    - attack.t1569.002\n    - attack.s0029\nlogsource:\n    category: pipe_created\n    product: windows\n    definition: 'Note that you have to configure logging for Named Pipe Events in Sysmon config (Event ID 17 and Event ID 18). The basic configuration is in popular sysmon configuration (https://github.com/SwiftOnSecurity/sysmon-config), but it is worth verifying. You can also use other repo, e.g. https://github.com/Neo23x0/sysmon-config, https://github.com/olafhartong/sysmon-modular. How to test detection? You can check powershell script from this site https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575'\ndetection:\n    selection:\n        PipeName: '\\PSEXESVC'\n        Image|contains: # Add or remove locations depending on how and if you execute Psexec in your env\n            - ':\\Users\\Public\\'\n            - ':\\Windows\\Temp\\'\n            - '\\AppData\\Local\\Temp\\'\n            - '\\Desktop\\'\n            - '\\Downloads\\'\n    condition: selection\nfalsepositives:\n    - Rare legitimate use of psexec from the locations mentioned above. This will require initial tuning based on your environment.\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1569.002","id":"T1569.002","name":"Service Execution","page":"techniques/enterprise/T1569.002/"}],"data_path":"data/detection-rules/41504465-5e3a-4a5b-a5b4-2a0baadd4463.json","kind":"sigma"}