{"id":"85adeb13-4fc9-4e68-8a4a-c7cb2c336eb7","title":"CobaltStrike Named Pipe Patterns","description":"Detects the creation of a named pipe with a pattern found in CobaltStrike malleable C2 profiles","author":"Florian Roth (Nextron Systems), Christian Burkard (Nextron Systems)","status":"test","level":"high","date":"2021-07-30","modified":"2024-01-26","tags":["attack.privilege-escalation","attack.stealth","attack.t1055","stp.1k"],"technique_ids":["T1055"],"logsource":{"product":"windows","category":"pipe_created","definition":"Note that you have to configure logging for Named Pipe Events in Sysmon config (Event ID 17 and Event ID 18). The basic configuration is in popular sysmon configuration (https://github.com/SwiftOnSecurity/sysmon-config), but it is worth verifying. You can also use other repo, e.g. https://github.com/Neo23x0/sysmon-config, https://github.com/olafhartong/sysmon-modular You can also use other repo, e.g. https://github.com/Neo23x0/sysmon-config, https://github.com/olafhartong/sysmon-modular. How to test detection? You can always use Cobalt Strike, but also you can check powershell script from this site https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575"},"falsepositives":["Chrome instances using the exact same pipe name \"mojo.xxx\"","Websense Endpoint using the pipe name \"DserNamePipe(R|W)\\d{1,5}\"","Some applications may just coincidentally use the pipe names which contain the same prefix as the ones used by CobaltStrike, e.g. \"f4c3\""],"references":["https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575","https://gist.github.com/MHaggis/6c600e524045a6d49c35291a21e10752"],"source_path":"rules/windows/pipe_created/pipe_created_hktl_cobaltstrike_susp_pipe_patterns.yml","source_sha256":"df71e2e571dc55ce3648db73da3a708948db011538ec39320fcde5e14503f6b3","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/pipe_created/pipe_created_hktl_cobaltstrike_susp_pipe_patterns.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: CobaltStrike Named Pipe Patterns\nid: 85adeb13-4fc9-4e68-8a4a-c7cb2c336eb7\nrelated:\n    - id: 0e7163d4-9e19-4fa7-9be6-000c61aad77a # Regex\n      type: similar\n    - id: d5601f8c-b26f-4ab0-9035-69e11a8d4ad2 # Generic\n      type: similar\nstatus: test\ndescription: Detects the creation of a named pipe with a pattern found in CobaltStrike malleable C2 profiles\nreferences:\n    - https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575\n    - https://gist.github.com/MHaggis/6c600e524045a6d49c35291a21e10752\nauthor: Florian Roth (Nextron Systems), Christian Burkard (Nextron Systems)\ndate: 2021-07-30\nmodified: 2024-01-26\ntags:\n    - attack.privilege-escalation\n    - attack.stealth\n    - attack.t1055\n    - stp.1k\nlogsource:\n    product: windows\n    category: pipe_created\n    definition: 'Note that you have to configure logging for Named Pipe Events in Sysmon config (Event ID 17 and Event ID 18). The basic configuration is in popular sysmon configuration (https://github.com/SwiftOnSecurity/sysmon-config), but it is worth verifying. You can also use other repo, e.g. https://github.com/Neo23x0/sysmon-config, https://github.com/olafhartong/sysmon-modular You can also use other repo, e.g. https://github.com/Neo23x0/sysmon-config, https://github.com/olafhartong/sysmon-modular. How to test detection? You can always use Cobalt Strike, but also you can check powershell script from this site https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575'\ndetection:\n    selection_malleable_profile_generic:\n        - PipeName|startswith:\n              - '\\DserNamePipe'\n              - '\\f4c3'\n              - '\\f53f'\n              - '\\fullduplex_'\n              - '\\mojo.5688.8052.183894939787088877'\n              - '\\mojo.5688.8052.35780273329370473'\n              - '\\MsFteWds'\n              - '\\msrpc_'\n              - '\\mypipe-f'\n              - '\\mypipe-h'\n              - '\\ntsvcs'\n              - '\\PGMessagePipe'\n              - '\\rpc_'\n              - '\\scerpc'\n              - '\\SearchTextHarvester'\n              - '\\spoolss'\n              - '\\win_svc'\n              - '\\win\\msrpc_'\n              - '\\windows.update.manager'\n              - '\\wkssvc'\n        - PipeName:\n              - '\\demoagent_11'\n              - '\\demoagent_22'\n    selection_malleable_profile_catalog_change_listener:\n        PipeName|startswith: '\\Winsock2\\CatalogChangeListener-'\n        PipeName|endswith: '-0,'\n    filter_main_generic:\n        PipeName:\n            - '\\wkssvc'\n            - '\\spoolss'\n            - '\\scerpc'\n            - '\\ntsvcs'\n            - '\\SearchTextHarvester'\n            - '\\PGMessagePipe'\n            - '\\MsFteWds'\n    filter_optional_websense:\n        Image|contains:\n            - ':\\Program Files\\Websense\\'\n            - ':\\Program Files (x86)\\Websense\\'\n        PipeName|startswith:\n            - '\\DserNamePipeR'\n            - '\\DserNamePipeW'\n    condition: 1 of selection_malleable_profile_* and not 1 of filter_main_* and not 1 of filter_optional_*\nfalsepositives:\n    - Chrome instances using the exact same pipe name \"mojo.xxx\"\n    - Websense Endpoint using the pipe name \"DserNamePipe(R|W)\\d{1,5}\"\n    - Some applications may just coincidentally use the pipe names which contain the same prefix as the ones used by CobaltStrike, e.g. \"f4c3\"\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1055","id":"T1055","name":"Process Injection","page":"techniques/enterprise/T1055/"}],"data_path":"data/detection-rules/85adeb13-4fc9-4e68-8a4a-c7cb2c336eb7.json","kind":"sigma"}