{"id":"d36f87ea-c403-44d2-aa79-1a0ac7c24456","title":"PUA - RemCom Default Named Pipe","description":"Detects default RemCom pipe creation","author":"Nikita Nazarov, oscd.community, Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2023-08-07","modified":"2023-11-30","tags":["attack.lateral-movement","attack.t1021.002","attack.execution","attack.t1569.002"],"technique_ids":["T1021.002","T1569.002"],"logsource":{"product":"windows","category":"pipe_created","definition":"Note that you have to configure logging for Named Pipe Events in Sysmon config (Event ID 17 and Event ID 18). The basic configuration is in popular sysmon configuration (https://github.com/SwiftOnSecurity/sysmon-config), but it is worth verifying. You can also use other repo, e.g. https://github.com/Neo23x0/sysmon-config, https://github.com/olafhartong/sysmon-modular. How to test detection? You can check powershell script from this site https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575"},"falsepositives":["Legitimate Administrator activity"],"references":["https://drive.google.com/file/d/1lKya3_mLnR3UQuCoiYruO3qgu052_iS_/view","https://github.com/kavika13/RemCom"],"source_path":"rules/windows/pipe_created/pipe_created_pua_remcom_default_pipe.yml","source_sha256":"348ff33823b219475fc405ac9bb1934572888c8013cce9c50f488da5abef08f0","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/pipe_created/pipe_created_pua_remcom_default_pipe.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: PUA - RemCom Default Named Pipe\nid: d36f87ea-c403-44d2-aa79-1a0ac7c24456\nrelated:\n    - id: 9e77ed63-2ecf-4c7b-b09d-640834882028\n      type: obsolete\nstatus: test\ndescription: Detects default RemCom pipe creation\nreferences:\n    - https://drive.google.com/file/d/1lKya3_mLnR3UQuCoiYruO3qgu052_iS_/view\n    - https://github.com/kavika13/RemCom\nauthor: Nikita Nazarov, oscd.community, Nasreddine Bencherchali (Nextron Systems)\ndate: 2023-08-07\nmodified: 2023-11-30\ntags:\n    - attack.lateral-movement\n    - attack.t1021.002\n    - attack.execution\n    - attack.t1569.002\nlogsource:\n    product: windows\n    category: pipe_created\n    definition: 'Note that you have to configure logging for Named Pipe Events in Sysmon config (Event ID 17 and Event ID 18). The basic configuration is in popular sysmon configuration (https://github.com/SwiftOnSecurity/sysmon-config), but it is worth verifying. You can also use other repo, e.g. https://github.com/Neo23x0/sysmon-config, https://github.com/olafhartong/sysmon-modular. How to test detection? You can check powershell script from this site https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575'\ndetection:\n    selection:\n        PipeName|contains: '\\RemCom'\n    condition: selection\nfalsepositives:\n    - Legitimate Administrator activity\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1021.002","id":"T1021.002","name":"SMB/Windows Admin Shares","page":"techniques/enterprise/T1021.002/"},{"key":"enterprise/T1569.002","id":"T1569.002","name":"Service Execution","page":"techniques/enterprise/T1569.002/"}],"data_path":"data/detection-rules/d36f87ea-c403-44d2-aa79-1a0ac7c24456.json","kind":"sigma"}