Query: write Sigma for Detects the creation of a named pipe seen used by known APTs or malware.
Matching passage: Sigma rule: Detects the creation of a named pipe seen used by known APTs or malware.. Logsource: windows / pipe_created. Rule: title: Malicious Named Pipe Created id: fe3ac066-98bb-432a-b1e7-a5229cb39d4a status: test description: Detects the creation of a named pipe seen used by known APTs or malware. references: - https://securelist.com/wild-neutron-economic-espionage-threat-actor-returns-with-new-tricks/71275/ - https://securelist.com/faq-the-projectsauron-apt/75533/ - https://web.archive.org/web/20180725233601/https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf - https://www.us-cert.gov/ncas/alerts/TA17-117A - https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html - https://thedfirreport.com/2020/06/21/snatch-ransomware/ - https://github.com/RiccardoAncarani/LiquidSnake - https://www.accenture.com/us-en/blogs/cyber-defense/turla-belugasturgeon-compromises-government-entity - https://us-cert.cisa.gov/ncas/analysis-reports/ar19-304a - https://download.bitdefender.com/resources/files/News/CaseStudies/study/115/Bitdefender-Whitepaper-PAC-A4-en-EN1.pdf - https://unit42.paloaltonetworks.com/emissary-panda-attacks-middle-east-government-sharepoint-servers/ - https://thedfirreport.com/2022/02/21/qbot-and-zerologon-lead-to-full-domain-compromise/ author: Florian Roth (Nextron Systems), blueteam0ps, elhoim date: 2017-11-06 modified: 2023-08-07 tags: - attack.privilege-escalation - attack.stealth - attack.t1055 logsource: product: windows category: pipe_created definition: Note that you have to configure logging for Named Pipe Events in Sysmon config (Event ID 17 and Event ID 18). The basic configuration is in popular sysmon configuration (https://github.com/SwiftOnSecurity/sysmon-config), but it is worth verifying. You can also use other repo, e.g. https://github.com/Neo23x0/sysmon-config, https://github.com/olafhartong/sysmon-modular. How to test detection? You can check powershell script from this site https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575 detection: selection: PipeName: - \46a676ab7f179e511e30dd2dc41bd388 - \583da945-62af-10e8-4902-a8f205c72b2e - \6e7645c4-32c5-4fe3-aabf-e94c2f4370e7 - \9f81f59bc58452127884ce513865ed20 - \adschemerpc - \ahexec - \AnonymousPipe - \bc31a7 - \bc367 - \bizkaz - \csexecsvc - \dce_3d - \e710f28d59aa529d6792ca6ff0ca1b34 - \gruntsvc - \isapi_dg - \isapi_dg2 - \isapi_http - \jaccdpqnvbrrxlaf - \lsassw - \NamePipe_MoreWindows - \pcheap_reuse - \Posh* - \rpchlp_3 - \sdlrpc - \svcctl - \testPipe -
Near-miss passage: Sigma rule: Detects potential registry persistence technique using the Event Viewer "Events.asp" technique. Logsource: windows / registry_set. Rule: title: Potential Persistence Via Event Viewer Events.asp id: a1e11042-a74a-46e6-b07c-c4ce8ecc239b status: test description: Detects potential registry persistence technique using the Event Viewer "Events.asp" technique references: - https://twitter.com/nas_bench/status/1626648985824788480 - https://admx.help/?Category=Windows_7_2008R2&Policy=Microsoft.Policies.InternetCommunicationManagement::EventViewer_DisableLinks - https://www.hexacorn.com/blog/2019/02/15/beyond-good-ol-run-key-part-103/ - https://github.com/redcanaryco/atomic-red-team/blob/f296668303c29d3f4c07e42bdd2b28d8dd6625f9/atomics/T1112/T1112.md author: Nasreddine Bencherchali (Nextron Systems) date: 2023-02-17 modified: 2023-03-05 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: category: registry_set product: windows detection: selection: TargetObject|contains: - \Microsoft\Windows NT\CurrentVersion\Event Viewer\MicrosoftRedirectionProgram - \Microsoft\Windows NT\CurrentVersion\Event Viewer\MicrosoftRedirectionURL filter_default_redirect_program: Image|endswith: C:\WINDOWS\system32\svchost.exe TargetObject|endswith: \Microsoft\Windows NT\CurrentVersion\Event Viewer\MicrosoftRedirectionProgram Details: '%%SystemRoot%%\PCHealth\HelpCtr\Binaries\HelpCtr.exe' filter_default_redirect_program_cli: Image|endswith: C:\WINDOWS\system32\svchost.exe TargetObject|endswith: \Microsoft\Windows NT\CurrentVersion\Event Viewer\MicrosoftRedirectionProgramCommandLineParameters Details: -url hcp://services/centers/support?topic=%%s filter_url: Details: http://go.microsoft.com/fwlink/events.asp filter_cleaner: Details: (Empty) condition: selection and not 1 of filter_* falsepositives: - Unknown level: medium