{"id":"58cb02d5-78ce-4692-b3e1-dce850aae41a","title":"Alternate PowerShell Hosts Pipe","description":"Detects alternate PowerShell hosts potentially bypassing detections looking for powershell.exe","author":"Roberto Rodriguez @Cyb3rWard0g, Tim Shelton","status":"test","level":"medium","date":"2019-09-12","modified":"2025-10-07","tags":["attack.execution","attack.t1059.001"],"technique_ids":["T1059.001"],"logsource":{"product":"windows","category":"pipe_created","definition":"Note that you have to configure logging for Named Pipe Events in Sysmon config (Event ID 17 and Event ID 18). The basic configuration is in popular sysmon configuration (https://github.com/SwiftOnSecurity/sysmon-config), but it is worth verifying. You can also use other repo, e.g. https://github.com/Neo23x0/sysmon-config, https://github.com/olafhartong/sysmon-modular. How to test detection? You can check powershell script from this site https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575"},"falsepositives":["Programs using PowerShell directly without invocation of a dedicated interpreter."],"references":["https://threathunterplaybook.com/hunts/windows/190610-PwshAlternateHosts/notebook.html","https://threathunterplaybook.com/hunts/windows/190410-LocalPwshExecution/notebook.html"],"source_path":"rules/windows/pipe_created/pipe_created_powershell_alternate_host_pipe.yml","source_sha256":"0a76adb129502772fd4d80866fe52b750d44b3b57f7296be0cf0570cf5a81329","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/pipe_created/pipe_created_powershell_alternate_host_pipe.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Alternate PowerShell Hosts Pipe\nid: 58cb02d5-78ce-4692-b3e1-dce850aae41a\nrelated:\n    - id: ac7102b4-9e1e-4802-9b4f-17c5524c015c\n      type: derived\nstatus: test\ndescription: Detects alternate PowerShell hosts potentially bypassing detections looking for powershell.exe\nreferences:\n    - https://threathunterplaybook.com/hunts/windows/190610-PwshAlternateHosts/notebook.html\n    - https://threathunterplaybook.com/hunts/windows/190410-LocalPwshExecution/notebook.html\nauthor: Roberto Rodriguez @Cyb3rWard0g, Tim Shelton\ndate: 2019-09-12\nmodified: 2025-10-07\ntags:\n    - attack.execution\n    - attack.t1059.001\nlogsource:\n    product: windows\n    category: pipe_created\n    definition: 'Note that you have to configure logging for Named Pipe Events in Sysmon config (Event ID 17 and Event ID 18). The basic configuration is in popular sysmon configuration (https://github.com/SwiftOnSecurity/sysmon-config), but it is worth verifying. You can also use other repo, e.g. https://github.com/Neo23x0/sysmon-config, https://github.com/olafhartong/sysmon-modular. How to test detection? You can check powershell script from this site https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575'\ndetection:\n    selection:\n        PipeName|startswith: '\\PSHost'\n    filter_main_generic:\n        - Image|contains:\n              - ':\\Program Files\\PowerShell\\7-preview\\pwsh.exe' # Powershell 7\n              - ':\\Program Files\\PowerShell\\7\\pwsh.exe' # Powershell 7\n              - ':\\Windows\\system32\\dsac.exe'\n              - ':\\Windows\\system32\\inetsrv\\w3wp.exe'   # this is sad :,( but it triggers FPs on Exchange servers\n              - ':\\Windows\\System32\\sdiagnhost.exe'\n              - ':\\Windows\\system32\\ServerManager.exe'\n              - ':\\Windows\\system32\\wbem\\wmiprvse.exe'\n              - ':\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell_ise.exe'\n              - ':\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe'\n              - ':\\Windows\\System32\\wsmprovhost.exe'\n              - ':\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell_ise.exe'\n              - ':\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe'\n        - Image|contains|all:\n              - 'C:\\Program Files\\WindowsApps\\Microsoft.PowerShellPreview'\n              - '\\pwsh.exe'\n        - Image|contains|all:\n              - '\\AppData\\Local\\Microsoft\\WindowsApps\\Microsoft.PowerShellPreview'\n              - '\\pwsh.exe'\n    filter_optional_sqlserver: # Microsoft SQL Server\\130\\Tools\\\n        Image|startswith:\n            - 'C:\\Program Files (x86)\\'\n            - 'C:\\Program Files\\'\n        Image|contains: '\\Microsoft SQL Server\\'\n        Image|endswith: '\\Tools\\Binn\\SQLPS.exe'\n    filter_optional_azure_connected_machine_agent:\n        # Azure Connected Machine Agent (https://devblogs.microsoft.com/powershell/azure-policy-guest-configuration-client/)\n        Image|startswith: 'C:\\Program Files\\AzureConnectedMachineAgent\\GCArcService'\n        Image|endswith: '\\GC\\gc_worker.exe'\n    filter_optional_citrix:\n        Image|startswith: 'C:\\Program Files\\Citrix\\'\n    filter_optional_exchange:\n        Image|startswith: 'C:\\Program Files\\Microsoft\\Exchange Server\\'\n    filter_main_null:\n        Image: null\n    condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*\nfalsepositives:\n    - Programs using PowerShell directly without invocation of a dedicated interpreter.\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1059.001","id":"T1059.001","name":"PowerShell","page":"techniques/enterprise/T1059.001/"}],"data_path":"data/detection-rules/58cb02d5-78ce-4692-b3e1-dce850aae41a.json","kind":"sigma"}