{"id":"d5601f8c-b26f-4ab0-9035-69e11a8d4ad2","title":"CobaltStrike Named Pipe","description":"Detects the creation of a named pipe as used by CobaltStrike","author":"Florian Roth (Nextron Systems), Wojciech Lesicki","status":"test","level":"critical","date":"2021-05-25","modified":"2022-10-31","tags":["attack.privilege-escalation","attack.stealth","attack.t1055"],"technique_ids":["T1055"],"logsource":{"product":"windows","category":"pipe_created","definition":"Note that you have to configure logging for Named Pipe Events in Sysmon config (Event ID 17 and Event ID 18). The basic configuration is in popular sysmon configuration (https://github.com/SwiftOnSecurity/sysmon-config), but it is worth verifying. You can also use other repo, e.g. https://github.com/Neo23x0/sysmon-config, https://github.com/olafhartong/sysmon-modular. How to test detection? You can always use Cobalt Strike, but also you can check powershell script from this site https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575"},"falsepositives":["Unknown"],"references":["https://twitter.com/d4rksystem/status/1357010969264873472","https://labs.f-secure.com/blog/detecting-cobalt-strike-default-modules-via-named-pipe-analysis/","https://github.com/SigmaHQ/sigma/issues/253","https://blog.cobaltstrike.com/2021/02/09/learn-pipe-fitting-for-all-of-your-offense-projects/","https://redcanary.com/threat-detection-report/threats/cobalt-strike/"],"source_path":"rules/windows/pipe_created/pipe_created_hktl_cobaltstrike.yml","source_sha256":"6db7226d98e661269b93d00172b707394932af99583e9c77a69c5543e8ea52d4","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/pipe_created/pipe_created_hktl_cobaltstrike.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: CobaltStrike Named Pipe\nid: d5601f8c-b26f-4ab0-9035-69e11a8d4ad2\nrelated:\n    - id: 85adeb13-4fc9-4e68-8a4a-c7cb2c336eb7 # Patterns\n      type: similar\n    - id: 0e7163d4-9e19-4fa7-9be6-000c61aad77a # Regex\n      type: similar\nstatus: test\ndescription: Detects the creation of a named pipe as used by CobaltStrike\nreferences:\n    - https://twitter.com/d4rksystem/status/1357010969264873472\n    - https://labs.f-secure.com/blog/detecting-cobalt-strike-default-modules-via-named-pipe-analysis/\n    - https://github.com/SigmaHQ/sigma/issues/253\n    - https://blog.cobaltstrike.com/2021/02/09/learn-pipe-fitting-for-all-of-your-offense-projects/\n    - https://redcanary.com/threat-detection-report/threats/cobalt-strike/\nauthor: Florian Roth (Nextron Systems), Wojciech Lesicki\ndate: 2021-05-25\nmodified: 2022-10-31\ntags:\n    - attack.privilege-escalation\n    - attack.stealth\n    - attack.t1055\nlogsource:\n    product: windows\n    category: pipe_created\n    definition: 'Note that you have to configure logging for Named Pipe Events in Sysmon config (Event ID 17 and Event ID 18). The basic configuration is in popular sysmon configuration (https://github.com/SwiftOnSecurity/sysmon-config), but it is worth verifying. You can also use other repo, e.g. https://github.com/Neo23x0/sysmon-config, https://github.com/olafhartong/sysmon-modular. How to test detection? You can always use Cobalt Strike, but also you can check powershell script from this site https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575'\ndetection:\n    selection_MSSE:\n        PipeName|contains|all:\n            - '\\MSSE-'\n            - '-server'\n    selection_postex:\n        PipeName|startswith: '\\postex_' # Also include the pipe \"\\postex_ssh_\"\n    selection_status:\n        PipeName|startswith: '\\status_'\n    selection_msagent:\n        PipeName|startswith: '\\msagent_'\n    selection_mojo:\n        PipeName|startswith: '\\mojo_'\n    selection_interprocess:\n        PipeName|startswith: '\\interprocess_'\n    selection_samr:\n        PipeName|startswith: '\\samr_'\n    selection_netlogon:\n        PipeName|startswith: '\\netlogon_'\n    selection_srvsvc:\n        PipeName|startswith: '\\srvsvc_'\n    selection_lsarpc:\n        PipeName|startswith: '\\lsarpc_'\n    selection_wkssvc:\n        PipeName|startswith: '\\wkssvc_'\n    condition: 1 of selection*\nfalsepositives:\n    - Unknown\nlevel: critical\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1055","id":"T1055","name":"Process Injection","page":"techniques/enterprise/T1055/"}],"data_path":"data/detection-rules/d5601f8c-b26f-4ab0-9035-69e11a8d4ad2.json","kind":"sigma"}