First Time Seen Remote Named Pipe — Sigma Rule

Rule metadata and linked tags

Author: Samir Bousseaden. Source status: test; severity: high. Source dates: 2019-04-03 / 2023-03-14.

{
  "product": "windows",
  "service": "security",
  "definition": "The advanced audit policy setting \"Object Access > Audit Detailed File Share\" must be configured for Success/Failure"
}

Pinned original Sigma rule · Detection Rule License 1.1

Source SHA-256: fd7e7d105c8baf3801ebb966e81a866455f77a2717dc40dea8ed06773ba77da4

Detection logic

Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.

title: First Time Seen Remote Named Pipe
id: 52d8b0c6-53d6-439a-9e41-52ad442ad9ad
status: test
description: This detection excludes known namped pipes accessible remotely and notify on newly observed ones, may help to detect lateral movement and remote exec using named pipes
references:
    - https://twitter.com/menasec1/status/1104489274387451904
author: Samir Bousseaden
date: 2019-04-03
modified: 2023-03-14
tags:
    - attack.lateral-movement
    - attack.t1021.002
logsource:
    product: windows
    service: security
    definition: 'The advanced audit policy setting "Object Access > Audit Detailed File Share" must be configured for Success/Failure'
detection:
    selection1:
        EventID: 5145
        ShareName: '\\\\\*\\IPC$' # looking for the string \\*\IPC$
    false_positives:
        RelativeTargetName:
            - 'atsvc'
            - 'samr'
            - 'lsarpc'
            - 'lsass'
            - 'winreg'
            - 'netlogon'
            - 'srvsvc'
            - 'protected_storage'
            - 'wkssvc'
            - 'browser'
            - 'netdfs'
            - 'svcctl'
            - 'spoolss'
            - 'ntsvcs'
            - 'LSM_API_service'
            - 'HydraLsPipe'
            - 'TermSrv_API_service'
            - 'MsFteWds'
            - 'sql\query'
            - 'eventlog'
    condition: selection1 and not false_positives
falsepositives:
    - Update the excluded named pipe to filter out any newly observed legit named pipe
level: high

Original YAML and metadata in JSON

False positives

• Update the excluded named pipe to filter out any newly observed legit named pipe

Source references

• https://twitter.com/menasec1/status/1104489274387451904