{"id":"f6451de4-df0a-41fa-8d72-b39f54a08db5","title":"PUA - PAExec Default Named Pipe","description":"Detects PAExec default named pipe","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2022-10-26","modified":"","tags":["attack.execution","attack.t1569.002"],"technique_ids":["T1569.002"],"logsource":{"category":"pipe_created","product":"windows","definition":"Note that you have to configure logging for Named Pipe Events in Sysmon config (Event ID 17 and Event ID 18). The basic configuration is in popular sysmon configuration (https://github.com/SwiftOnSecurity/sysmon-config), but it is worth verifying. You can also use other repo, e.g. https://github.com/Neo23x0/sysmon-config, https://github.com/olafhartong/sysmon-modular. How to test detection? You can check powershell script from this site https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575"},"falsepositives":["Unknown"],"references":["https://github.com/microsoft/Microsoft-365-Defender-Hunting-Queries/blob/efa17a600b43c897b4b7463cc8541daa1987eeb4/Command%20and%20Control/C2-NamedPipe.md","https://github.com/poweradminllc/PAExec"],"source_path":"rules/windows/pipe_created/pipe_created_pua_paexec_default_pipe.yml","source_sha256":"8cfb983dcd4832d29428b2273b0f6a207c76b63de84793cba07823dfa9cc6b00","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/pipe_created/pipe_created_pua_paexec_default_pipe.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: PUA - PAExec Default Named Pipe\nid: f6451de4-df0a-41fa-8d72-b39f54a08db5\nstatus: test\ndescription: Detects PAExec default named pipe\nreferences:\n    - https://github.com/microsoft/Microsoft-365-Defender-Hunting-Queries/blob/efa17a600b43c897b4b7463cc8541daa1987eeb4/Command%20and%20Control/C2-NamedPipe.md\n    - https://github.com/poweradminllc/PAExec\nauthor: Nasreddine Bencherchali (Nextron Systems)\ndate: 2022-10-26\ntags:\n    - attack.execution\n    - attack.t1569.002\nlogsource:\n    category: pipe_created\n    product: windows\n    definition: 'Note that you have to configure logging for Named Pipe Events in Sysmon config (Event ID 17 and Event ID 18). The basic configuration is in popular sysmon configuration (https://github.com/SwiftOnSecurity/sysmon-config), but it is worth verifying. You can also use other repo, e.g. https://github.com/Neo23x0/sysmon-config, https://github.com/olafhartong/sysmon-modular. How to test detection? You can check powershell script from this site https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575'\ndetection:\n    selection:\n        PipeName|startswith: '\\PAExec'\n    condition: selection\nfalsepositives:\n    - Unknown\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1569.002","id":"T1569.002","name":"Service Execution","page":"techniques/enterprise/T1569.002/"}],"data_path":"data/detection-rules/f6451de4-df0a-41fa-8d72-b39f54a08db5.json","kind":"sigma"}