ADFS Database Named Pipe Connection By Uncommon Tool — Sigma Rule

Rule metadata and linked tags

Author: Roberto Rodriguez @Cyb3rWard0g. Source status: test; severity: medium. Source dates: 2021-10-08 / 2023-11-30.

{
  "product": "windows",
  "category": "pipe_created",
  "definition": "Note that you have to configure logging for Named Pipe Events in Sysmon config (Event ID 17 and Event ID 18). The basic configuration is in popular sysmon configuration (https://github.com/SwiftOnSecurity/sysmon-config), but it is worth verifying. You can also use other repo, e.g. https://github.com/Neo23x0/sysmon-config, https://github.com/olafhartong/sysmon-modular. How to test detection? You can check powershell script from this site https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575"
}

Pinned original Sigma rule · Detection Rule License 1.1

Source SHA-256: f2f8221fc26b2daa9fd19ab04671aeda3e8aa02bb3536b3a9c752308aff58e9b

Detection logic

Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.

title: ADFS Database Named Pipe Connection By Uncommon Tool
id: 1ea13e8c-03ea-409b-877d-ce5c3d2c1cb3
status: test
description: |
    Detects suspicious local connections via a named pipe to the AD FS configuration database (Windows Internal Database).
    Used to access information such as the AD FS configuration settings which contains sensitive information used to sign SAML tokens.
references:
    - https://github.com/Azure/Azure-Sentinel/blob/f99542b94afe0ad2f19a82cc08262e7ac8e1428e/Detections/SecurityEvent/ADFSDBNamedPipeConnection.yaml
    - https://o365blog.com/post/adfs/
    - https://github.com/Azure/SimuLand
author: Roberto Rodriguez @Cyb3rWard0g
date: 2021-10-08
modified: 2023-11-30
tags:
    - attack.collection
    - attack.t1005
logsource:
    product: windows
    category: pipe_created
    definition: 'Note that you have to configure logging for Named Pipe Events in Sysmon config (Event ID 17 and Event ID 18). The basic configuration is in popular sysmon configuration (https://github.com/SwiftOnSecurity/sysmon-config), but it is worth verifying. You can also use other repo, e.g. https://github.com/Neo23x0/sysmon-config, https://github.com/olafhartong/sysmon-modular. How to test detection? You can check powershell script from this site https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575'
detection:
    selection:
        PipeName: '\MICROSOFT##WID\tsql\query'
    filter_main_generic:
        Image|endswith:
            - ':\Windows\System32\mmc.exe'
            - ':\Windows\system32\svchost.exe'
            - ':\Windows\System32\wsmprovhost.exe'
            - ':\Windows\SysWOW64\mmc.exe'
            - ':\Windows\SysWOW64\wsmprovhost.exe'
            - ':\Windows\WID\Binn\sqlwriter.exe'
            - '\AzureADConnect.exe'
            - '\Microsoft.Identity.Health.Adfs.PshSurrogate.exe'
            - '\Microsoft.IdentityServer.ServiceHost.exe'
            - '\Microsoft.Tri.Sensor.exe'
            - '\sqlservr.exe'
            - '\tssdis.exe'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Unknown
level: medium

Original YAML and metadata in JSON

False positives

• Unknown

Source references

• https://github.com/Azure/Azure-Sentinel/blob/f99542b94afe0ad2f19a82cc08262e7ac8e1428e/Detections/SecurityEvent/ADFSDBNamedPipeConnection.yaml
• https://o365blog.com/post/adfs/
• https://github.com/Azure/SimuLand